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Binary Compatible with Large 
Software Base 

— IVIS-DOS*, OS/2**, Windows* 

— UNIX*** System V/386 

— IRMX®, IRMKTM Kernels 

High Integration Enables On-Chip 
^ 8 Kbyte Code and Data Cache 

— Floating Point Unit 

— Paged, Virtual Memory Management 

Easy To Use 

^ Built-in Self Test 

— Hardware Debugging Support 

— Intel Software Support 

— Extensive Third Party Software 
Support 

IEEE 1149.1 Boundary Scan 
Compatibility 

— Available on 50 MHz Version Only 

Upgradable to Intel OverDrive^M 
Processor 



168-Pin Grid Array Package 

High Performance Design 

— RISC Integer Core with Frequent 
Instructions Executing in One Clock 

— 25 MHz, 33 MHz, and 50 MHz Clock 

— 80, 106, 160 Mbyte/sec Burst Bus 

— CHMOS IV and CHMOS V Process 
Technology 

— Dynamic Bus Sizing for 8-, 16-, and 
32-Bit Busses 

Complete 32-Bit Architecture 

— Address and Data Busses 

— Registers 

— 8-, 16- and 32-Bit Data Types 

Multiprocessor Support 

— Multiprocessor Instructions 

— Cache Consistency Protocols 

— Support for Second Level Cache 



The Intel486 CPU offers the highest performance for DOS, OS/2, Windows, and UNIX System V/386 applica- 
tions. It is 100% binary compatible with the lntel386TM CPU. Over one million transistors integrate the RISC 
integer core, 8 Kbyte cache memory, floating point hardware, and memory management on-chip while retain- 
ing binary compatibility with previous members of the Intel386/lntel486 architectural family. The RISC integer 
core executes frequently-used instructions in one cycle, providing leadership performance levels. An 8 Kbyte 
unified code and data cache allow the high performance levels to be sustained. A 160 MByte/sec burst bus at 
50 MHz ensures high system throughput even with inexpensive DRAMs. 
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New features enhance multiprocessing systems; new instructions speed manipulation of memory-based sem- 
aphores; and on-chip hardware ensures cache consistency and provides hooks for multilevel caches. 

The built-in self-test extensively tests on-chip logic, cache memory, and the on-chip paging translation cache. 
Debug features include breakpoint traps on code execution and data accesses. 

The Intel OverDrive Processor provides optional overall performance upgrade capability for users who want to 
increase their system performance up to 70% on DOS, Windows, OS/2 and Unix applications. 



IRMX, IRMK, Intel386, Intel387, Intel486, i486, OverDrive, and OverDrive Ready are trademarks of Intel Corporation. 
•MS-DOS® and Windows are registered trademarks of Microsoft Corporation. 
**0S/2TM is a trademark of International Business Machines Corporation. 
***UNIXTM is a trademark of UNIX Systems Laboratories. 
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Pin Cross Reference by Pin Name 
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Data 
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(50 MHz Only) 
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NOTE: 

1 . These pins are no longer No-Connects on the 50 MHz version. 
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QUICK PIN REFERENCE 

What follows is a brief pin description. For detailed signal descriptions refer to Section 6. 



Symbol 


Type 


Name and Function 


CLK 


1 


Clock provides the fundamental timing and the internal operating frequency for the 
Intel486 Microprocessor. All external timing parameters are specified with respect to 
the rising edge of CLK. 


ADDRESS BUS 


A31-A4 
A2-A3 


I/O 



A31 -A2 are the address lines of the microprocessor. A31 -A2, together with the byte 
enables BE0#-BE3#, define the physical area of memory or input/output space 
accessed. Address lines A31 -A4 are used to drive addresses into the microprocessor 
to perform cache line invalidations. Input signals must meet setup and hold times t22 
and t23. A31 -A2 are not driven during bus or address hold. 


BE0-3# 





The byte enable signals indicate active bytes during read and write cycles. During the 
first cycle of a cache fill, the external system should assume that all byte enables are 
active. BE3# applies to D24-D31, BE2# applies to D16-D23, BE1 # applies to D8- 
D16 and BEO# applies to D0-D7. BE0#-BE3# are active LOW and are not driven 
during bus hold. 


DATA BUS 


D31-D0 


I/O 


These are the data lines for the Intel486 Microprocessor. Lines D0-D7 define the least 
significant byte of the data bus while lines D24-D31 define the most significant byte of 
the data bus. These signals must meet setup and hold times t22 and t23 for proper 
operation on reads. These pins are driven during the second and subsequent clocks of 
write cycles. 


DATA PARITY 


DP0-DP3 


I/O 


There is one data parity ^\n for each byte of the data bus. Data parity is generated on all 
write data cycles with the same timing as the data driven by the Intel486 
Microprocessor. Even parity information must be driven back into the microprocessor 
on the data parity pins with the same timing as read information to insure that the 
correct parity check status is indicated by the Intel486 microprocessor. The signals 
read on these pins do not affect program execution. 

Input signals must meet setup and hold times t22 and t23. DP0-DP3 should be 
connected to Vcc through a pullup resistor in systems which do not use parity. 
DP0-DP3 are active HIGH and are driven during the second and subsequent clocks of 
write cycles. 


PCHK# 





Parity Status is driven on the PCHK# pin the clock after ready for read operations. The 
parity status is for data sampled at the end of the previous clock. A parity error is 
indicated by PCHK# being LOW. Parity status is only checked for enabled bytes as 
indicated by the byte enable and bus size signals. PCHK# is valid only in the clock 
immediately after read data is returned to the microprocessor. At all other times 
PCHK# is inactive (HIGH). PCHK# is never floated. 
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QUICK PIN REFERENCE (Continued) 



Symbol 


Type 


Name and Function 


BUS CYCLE DEFINITION 


M/IO# 

D/C# 

W/R# 







The memory/input-output, data/control qx\(\ write/read Wnes are the primary bus 
definition signals. These signals are driven valid as the ADS# signal is asserted. 


M/IO# D/C# W/R# Bus Cycle Initiated 


Interrupt Acknowledge 
1 Halt/Special Cycle 
1 I/O Read 

1 1 I/O Write 

1 Code Read 
1 1 Reserved 

1 1 Memory Read 
1 1 1 Memory Write 


The bus definition signals are not driven during bus hold and follow the timing of the 
address bus. Refer to Section 7.2.1 1 for a description of the special bus cycles. 


LOCK# 





The bus lock pin indicates that the current bus cycle is locked. The Intel486 
Microprocessor will not allow a bus hold when LOCK# is asserted (but address holds 
are allowed). LOCK# goes active in the first clock of the first locked bus cycle and goes 
inactive after the last clock of the last locked bus cycle. The last locked cycle ends 
when ready is returned. LOCK# is active LOW and is not driven during bus hold. Locked 
read cycles will not be transformed into cache fill cycles if KEN # is returned active. 


PLOCK# 





The pseudo-lock pin Indicates that the current bus transaction requires more than one 
bus cycle to complete. Examples of such operations are floating point long reads and 
writes (64 bits), segment table descriptor reads (64 bits), in addition to cache line fills 
(128 bits). The Intel486 Microprocessor will drive PLOCK# active until the addresses for 
the last bus cycle of the transaction have been driven regardless of whether RDY# or 
BRDY# have been returned. 

Normally PLOCK# and BLAST# are inverse of each other. However during the first bus 
cycle of a 64-bit floating point write, both FLOCK # and BLAST # will be asserted. 
FLOCK # is a function of the BS8#, BS16# and KEN# inputs. FLOCK # should be 
sampled only in the clock ready is returned. FLOCK # is active LOW and is not driven 
during bus hold. 


BUS CONTROL 


ADS# 





The address status output indicates that a valid bus cycle definition and address are 
available on the cycle definition lines and address bus. ADS# is driven active in the 
same clock as the addresses are driven. ADS# is active LOW and is not driven during 
bus hold. 


RDY# 


1 


The non-burst ready '\npuX indicates that the current bus cycle is complete. RDY# 

indicates that the external system has presented valid data on the data pins in response 

to a read or that the external system has accepted data from the Intel486 

Microprocessor in response to a write. RDY# is ignored when the bus is idle and at the 

end of the first clock of the bus cycle. 

RDY# is active during address hold. Data can be returned to the processor while 

AHOLD is active. 

RDY# is active LOW, and is not provided with an internal pullup resistor. RDY# must 

satisfy setup and hold times tie and tiy for proper chip operation. 
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QUICK PIN REFERENCE (Continued) 



Symbol 


Type 


Name and Function 


BURST CONTROL 


BRDY# 


1 


The burst ready input performs the same function during a burst cycle that RDY# 

performs during a non-burst cycle. BRDY# Indicates that the external system has 

presented valid data In response to a read or that the external system has accepted data 

In response to a write. BRDY# Is Ignored when the bus Is Idle and at the end of the first 

clock In a bus cycle. 

BRDY# Is sampled in the second and subsequent clocks of a burst cycle. The data 

presented on the data bus will be strobed Into the microprocessor when BRDY# is 

sampled active. If RDY# is returned simultaneously with BRDY#, BRDY# is ignored 

and the burst cycle Is prematurely aborted. 

BRDY# is active LOW and is provided with a small pullup resistor. BRDY# must satisfy 

the setup and hold times t-ie and X^-j. 


BLAST# 


O 


The burst fast signal Indicates that the next time BRDY# is returned the burst bus cycle 
is complete. BLAST# is active for both burst and non-burst bus cycles. BLAST# is 
active LOW and is not driven during bus hold. 


INTERRUPTS 


RESET 


1 


The reset mput forces the Intel486 Microprocessor to begin execution at a known state. 
The microprocessor cannot begin execution of instructions until at least 1 ms after Vcc 
and CLK have reached their proper DC and AC specifications. The RESET pin should 
remain active during this time to Insure proper microprocessor operation. RESET is 
active HIGH. RESET is asynchronous but must meet setup and hold times t2o and t2i for 
recognition In any specific clock. 


INTR 


1 


The maskable interrupt indicates that an external Interrupt has been generated. If the 
Internal interrupt flag is set in EFLAGS, active Interrupt processing will be initiated. The 
Intel486 Microprocessor will generate two locked interrupt acknowledge bus cycles in 
response to the INTR pin going active. INTR must remain active until the Interrupt 
acknowledges have been performed to assure that the Interrupt is recognized. 
INTR is active HIGH and is not provided with an Internal pulldown resistor. INTR is 
asynchronous, but must meet setup and hold times t2o and t2i for recognition in any 
specific clock. 


NMI 


1 


The non-mas/(abie interrupt request signal indicates that an external non-maskable 
Interrupt has been generated. NMI is rising edge sensitive. NMI must be held LOW for at 
least four CLK periods before this rising edge. NMI Is not provided with an Internal 
pulldown resistor. NMI is asynchronous, but must meet setup and hold times t2o and t2i 
for recognition In any specific clock. 


BUS ARBITRATION 


BREQ 





The internal cycle pending signal indicates that the Intel486 Microprocessor has 
Internally generated a bus request. BREQ Is generated whether or not the Intel486 
Microprocessor Is driving the bus. BREQ is active HIGH and is never floated. 


HOLD 


1 


The bus hold request aWoyNS another bus master complete control of the Intel486 
Microprocessor bus. In response to HOLD going active the Intel486 Microprocessor will 
float most of Its output and input/output pins. HLDA will be asserted after completing the 
current bus cycle, burst cycle or sequence of locked cycles. The Intel486 
Microprocessor will remain In this state until HOLD Is deasserted. HOLD is active high 
and Is not provided with an internal pulldown resistor. HOLD must satisfy setup and hold 
times ti 8 and ti 9 for proper operation. 


HLDA 





Hold acknowledge goes active in response to a hold request presented on the HOLD 
pin. HLDA Indicates that the Intel486 microprocessor has given the bus to another local 
bus master. HLDA is driven active In the same clock that the Intel486 Microprocessor 
floats its bus. HLDA is driven Inactive when leaving bus hold. HLDA Is active HIGH and 
remains driven during bus hold. 
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QUICK PIN REFERENCE (Continued) 



Symbol 


Type 


Name and Function 


BUS ARBITRATION (Continued) 


BOFF# 


1 


The backoff'mpui forces the Intel486 Microprocessor to float its bus in the next clock. 
The microprocessor will float all pins normally floated during bus hold but HLDA will not 
be asserted In response to BOFF#. BOFF# has higher priority than RDY# or BRDY#; 
if both are returned in the same clock, BOFF# takes effect. The microprocessor 
remains in bus hold until BOFF# is negated. If a bus cycle was in progress when 
BOFF# was asserted the cycle will be restarted. BOFF# is active LOW and must meet 
setup and hold times tie and tig for proper operation. 


CACHE INVALIDATION 


AHOLD 


1 


The address hold request allows another bus master access to the Intel486 
Microprocessor's address bus for a cache invalidation cycle. The Intel486 
Microprocessor will stop driving Its address bus in the clock following AHOLD going 
active. Only the address bus will be floated during address hold, the remainder of the 
bus will remain active. AHOLD is active HIGH and is provided with a small internal 
pulldown resistor. For proper operation AHOLD must meet setup and hold times tie and 
ti9. 


EADS# 


1 


This signal indicates that a valid external address has been driven onto the Intel486 
Microprocessor address pins. This address will be used to perform an internal cache 
invalidation cycle. EADS# is active LOW and is provided with an internal pullup resistor. 
EADS# must satisfy setup and hold times ti2 and t-ia for proper operation. 


CACHE CONTROL 


KEN# 


1 


The cache enable pin is used to determine whether the current cycle is cacheable. 
When the Intel486 microprocessor generates a cycle that can be cached and KEN# is 
active one clock before RDY# or BRDY# during the first transfer of the cycle, the cycle 
will become a cache line fill cycle. Returning KEN# active one clock before RDY# 
during the last read in the cache line fill will cause the line to be placed in the on-chip 
cache. KEN # is active LOW and is provided with a small internal pullup resistor. KEN # 
must satisfy setup and hold times ti4 and ti5 for proper operation. 


FLUSH # 


1 


The cache flush Input forces the Intel486 Microprocessor to flush its entire Internal 
cache. FLUSH # is active low and need only be asserted for one clock. FLUSH # is 
asynchronous but setup and hold times t2o and \2^ must be met for recognition in any 
specific clock. FLUSH # being sampled low in the clock before the falling edge of 
RESET causes the Intel486 Microprocessor to enter the tri-state test mode. 


PAGE CACHEABILITY 


PWT 
PCD 






The page write-through and page cache disable pins reflect the state of the page 
attribute bits, PWT and PCD, in the page table entry or page directory entry. If paging Is 
disabled or for cycles that are not paged, PWT and PCD reflect the state of the PWT and 
PCD bits in control register 3. PWT and PCD have the same timing as the cycle definition 
pins (M/IO#, D/C# and W/R#). PWT and PCD are active HIGH and are not driven 
during bus hold. PCD is masked by the cache disable bit (CD) in Control Register 0. 


NUMERIC ERROR REPORTING 


FERR# 





The floating point error p\x\ is driven active when a floating point error occurs. FERR# is 
similar to the ERROR # pin on the 387tm math coprocessor. FERR# is included for 
compatibility with systems using DOS type floating point error reporting. FERR# will not 
go active if FP errors are masked in FPU register. FERR# is active LOW, and is not 
floated during bus hold. 
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QUICK PIN REFERENCE (Continued) 



Symbol 


Type 


Name and Function 


NUMERIC ERROR REPORTING (Continued) 


IGNNE# 


1 


When the ignore numeric error pin is asserted the Intel486 Microprocessor will ignore a 
numeric error and continue executing non-control floating point instructions, but FERR# 
will still be activated by the Intel486. When IGNNE# is deasserted the Intel486 
microprocessor will freeze on a non-control floating point instruction, If a previous 
floating point instruction caused an error. IGNNE# has no effect when the NE bit in 
control register is set. IGNNE# is active LOW and is provided with a small internal 
pullup resistor. IGNNE# is asynchronous but setup and hold times t2o and t2i must be 
met to insure recognition on any specific clock. 


BUS SIZE CONTROL 


BS16# 
BS8# 


1 

1 


The bus size 16 and bus size 8 pins (bus sizing pins) cause the Intel486 Microprocessor 
to run multiple bus cycles to complete a request from devices that cannot provide or 
accept 32 bits of data in a single cycle. The bus sizing pins are sampled every clock. The 
state of these pins in the clock before ready is used by the Intel486 microprocessor to 
determine the bus size. These signals are active LOW and are provided with internal 
pullup resistors. These inputs must satisfy setup and hold times ti4 and ti5 for proper 
operation. 


ADDRESS MASK 


A20M# 


1 


When Xhe address bit 20 masl< p\n is asserted, the Intel486 Microprocessor masks 
physical address bit 20 (A20) before performing a lookup to the internal cache or driving 
a memory cycle on the bus. A20M# emulates the address wraparound at one Mbyte 
which occurs on the 8086. A20M# Is active LOW and should be asserted only when the 
processor is in real mode. This pin is asynchronous but should meet setup and hold 
times t2o and t2i for recognition in any specific clock. For proper operation, A20M# 
should be sampled high at the falling edge of RESET. 


TEST ACCESS PORT (50 MHz Version Only) 


TCK 


1 


Test Clocl< is an input to the Intel486 CPU and provides the clocking function required by 
the JTAG boundary scan feature. TCK is used to clock state Information and data Into 
and out of the component. State select information and data are clocked into the 
component on the rising edge of TCK on TMS and TDI, respectively. Data is clocked out 
of the part on the falling edge of TCK on TDO. 


TDI 


1 


Test Data Input is the serial input used to shift JTAG instructions and data into the 
component. TDI is sampled on the rising edge of TCK, during the SHIFT-IR and the 
SHIFT-DR TAP controller states. During all other tap controller states, TDI Is a "don't 
care". 


TDO 





Test Data Output is the serial output used to shift JTAG instructions and data out of the 
component. TDO is driven on the falling edge of TCK during the SHIFT-IR and 
SHIFT-DR TAP controller states. At all other times TDO is driven to the high impedance 
state. 


IMS 


1 


Test Mode Select Is decoded by the JTAG TAP (Tap Access Port) to select the 
operation of the test logic. TMS is sampled on the rising edge of TCK. To guarantee 
deterministic behavior of the TAP controller TMS is provided with an internal pull-up 
resistor. 
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Table 1.1. Output Pins 



Table 1.4. Test Pins (50 MHz Version Only) 



Name 


Active 


When 


Level 


Floated 


BREQ 


HIGH 




HLDA 


HIGH 




BE0#-BE3# 


LOW 


Bus Hold 


PWT, PCD 


HIGH 


Bus Hold 


W/R#,D/C#.M/IO# 


HIGH 


Bus Hold 


LOCK# 


LOW 


Bus Hold 


PLOCK# 


LOW 


Bus Hold 


ADS# 


LOW 


Bus Hold 


BLAST# 


LOW 


Bus Hold 


PCHK# 


LOW 




FERR# 


LOW 




A2-A3 


HIGH 


Bus, Address Hold 



Table 1.2. Input Pins 



Name 


Active 


Synchronous/ 




Level 


Asynchronous 


CLK 






RESET 


HIGH 


Asynchronous 


HOLD 


HIGH 


Synchronous 


AHOLD 


HIGH 


Synchronous 


EADS# 


LOW 


Synchronous 


BOFF# 


LOW 


Synchronous 


FLUSH # 


LOW 


Asynchronous 


A20M# 


LOW 


Asynchronous 


BS16#,BS8# 


LOW 


Synchronous 


KEN# 


LOW 


Synchronous 


RDY# 


LOW 


Synchronous 


BRDY# 


LOW 


Synchronous 


INTR 


HIGH 


Asynchronous 


NMI 


HIGH 


Asynchronous 


IGNNE# 


LOW 


Asynchronous 



Name 


Input or 
Output 


Sampled/ 
Driven On 


TCK 


Input 


N/A 


TDI 


Input 


Rising Edge of TCK 


TDO 


Output 


Falling Edge of TCK 


IMS 


Input 


Rising Edge of TCK 



Table 1.5. Component and Revision ID 



lntel486TM CPU 
Stepping Name 


Component 
ID 


Revision 
ID 


B3 


04 


01 


B4 


04 


01 


B5 


04 


01 


B6 


04 


01 


CO 


04 


02 


C1 


04 


03 


DO 


04 


04 


CA2 


04 


10 


cA3 


04 


10 


cBO 


04 


11 


cB1 


04 


11 


Intel OverDriveTM 

Processor 
Stepping Name 


A2 


04 


32 


B1 


04 


33 



Table 1.3. Input/Output Pins 



Name 


Active 
Level 


When 
Floated 


D0-D31 
DP0~DP3 
A4-A31 


HIGH 
HIGH 
HIGH 


Bus Hold 

Bus Hold 

Bus, Address Hold 
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2.0 ARCHITECTURAL OVERVIEW 

The Intel486 Microprocessor is a 32-bit architecture 
with on-chip memory management, floating point 
and cache memory units. 

The Intel486 Microprocessor contains all the fea- 
tures of the 386TM Microprocessor with enhance- 
ments to increase performance. The instruction set 
includes the complete 386 microprocessor instruc- 
tion set along with extensions to serve new applica- 
tions. The on-chip memory management unit (MMU) 
is completely compatible with the 386 Microproces- 
sor MMU. The Intel486 Microprocessor brings the 
387TM math coprocessor on-chip. All software writ- 
ten for the 386 microprocessor, 387 math coproces- 
sor and previous members of the 86/87 architectur- 
al family will run on the Intel486 Microprocessor 
without any modifications. 

Several enhancements have been added to the In- 
tel486 Microprocessor to Increase performance. On- 
chip cache memory allows frequently used data and 
code to be stored on-chip reducing accesses to the 
external bus. RISC design techniques have been 
used to reduce instruction cycle times. A burst bus 
feature enables fast cache fills. All of these features, 
combined, lead to performance greater than twice 
that of a 386 Microprocessor. 

The memory management unit (MMU) consists of a 
segmentation unit and a paging unit. Segmentation 
allows management of the logical address space by 
providing easy data and code relocatibllity and effi- 
cient sharing of global resources. The paging mech- 
anism operates beneath segmentation and is trans- 
parent to the segmentation process. Paging is 
optional and can be disabled by system software. 
Each segment can be divided into one or more 
4 Kbyte segments. To implement a virtual memory 
system, the Intel486 Microprocessor supports full re- 
startability for all page and segment faults. 

Memory is organized into one or more variable 
length segments, each up to four gigabytes (232 
bytes) In size. A segment can have attributes associ- 
ated with it which include its location, size, type (i.e., 
stack, code or data), and protection characteristics. 
Each task on an Intel486 Microprocessor can have a 
maximum of 16,381 segments, each up to four giga- 
bytes in size. Thus each task has a maximum of 64 
terabytes (trillion bytes) of virtual memory. 

The segmentation unit provides four-levels of pro- 
tection for isolating and protecting applications and 
the operating system from each other. The hardware 
enforced protection allows the design of systems 
with a high degree of integrity. 



The Intel486 Microprocessor has two modes of op- 
eration: Real Address Mode (Real Mode) and Pro- 
tected Mode Virtual Address Mode (Protected 
Mode). In Real Mode the Intel486 Microprocessor 
operates as a very fast 8086. Real Mode is required 
prinriarily to set up the processor for Protected Mode 
operation. Protected Mode provides access to the 
sophisticated memory management paging and priv- 
ilege capabilities of the processor. 

Within Protected Mode, software can perform a task 
switch to enter into tasks designated as Virtual 8086 
Mode tasks. Each virtual 8086 task behaves with 
8086 semantics, allowing 8086 software (an applica- 
tion program or an entire operating system) to exe- 
cute. 

The on-chip floating point unit operates in parallel 
with the arithmetic and logic unit and provides arith- 
metic instructions for a variety of numeric data types. 
It executes numerous built-in transcendental func- 
tions (e.g., tangent, sine, cosine, and log functions). 
The floating point unit fully conforms to the ANSI/ 
IEEE standard 754-1985 for floating point arithmetic. 

The on-chip cache is 8 Kbytes in size. It is 4-way set 
associative and follows a write-through policy. The 
on-chip cache includes features to provide flexibility 
in external memory system design. Individual pages 
can be designated as cacheable or non-cacheable 
by software or hardware. The cache can also be en- 
abled and disabled by software or hardware. 

Finally the Intel486 Microprocessor has features to 
facilitate high performance hardware designs. The 
IX clock eases high frequency board level designs. 
The burst bus feature enables fast cache fills. These 
features are described beginning in Section 6. 



2.1 Register Set 

The Intel486 Microprocessor register set includes all 
the registers contained in the 386 Microprocessor 
and the 387 math coprocessor. The register set can 
be split into the following categories: 

Base Architecture Registers 
General Purpose Registers 
Instruction Pointer 
Flags Register 
Segment Registers 

Systems Level Registers 
Control Registers 
System Address Registers 
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Floating Point Registers 
Data Registers 
Tag Word 
Status Word 

Instruction and Data Pointers 
Control Word 

Debug and Test Registers 

The base architecture and floating point registers 
are accessible by the applications program. The sys- 
tem level registers are only accessible at privilege 
level and are used by the systems level program. 
The debug and test registers are also only accessi- 
ble at privilege level 0. 

2.1.1 BASE ARCHITECTURE REGISTERS 

Figure 2.1 shows the Intel486 Microprocessor base 
architecture registers. The contents of these regis- 
ters are task-specific and are automatically loaded 
with a new context upon a task switch operation. 





31 


General P 

24 1 23 16 


urpose Registers 

15 8|7 






' 


AH AX AL 


EAX 

EBX 

ECX 

EDX 

ESI 

EDI 

EBP 

ESP 




BH BX BL 




CH CX CL 
1 




DH DX DL 

1 




SI 




Dl 




BP 




SP 






Segment Registers 

15 








CS Code Segment 
SS stack Segment 






DS ■ 
ES 
FS 
GS . 


. Data Segments 
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EIP 






Flags Register 










FLAGS 


EFLAGS 











Figure 2.1. Base Architecture Registers 



The base architecture includes six directly accessi- 
ble descriptors, each specifying a segment up to 
4 Gbytes in size. The descriptors are indicated by 
the selector values placed in the Intel486 Microproc- 
essor segment registers. Various selector values 
can be loaded as a program executes. 

The selectors are also task-specific, so the segment 
registers are automatically loaded with new context 
upon a task switch operation. 

2.1.1.1 General Purpose Registers 

The eight 32-bit general purpose registers are 
shown in Figure 2.1. These registers hold data or 
address quantities. The general purpose registers 
can support data operands of 1, 8, 16 and 32 bits, 
and bit fields of 1 to 32 bits. Address operands of 1 6 
and 32 bits are supported. The 32-bit registers are 
named EAX, EBX. ECX. EDX, ESI, EDI, EBP and 
ESP. 

The least significant 16 bits of the general purpose 
registers can be accessed separately by using the 
16-bit names of the registers AX, BX, CX, DX, SI, Dl, 
BP and SP. The upper 16 bits of the register are not 
changed when the lower 1 6 bits are accessed sepa- 
rately. 

Finally 8-bit operations can individually access the 
lowest byte (bits 0-7) and the higher byte (bits 
8-15) of the general purpose registers AX, BX, CX 
and DX. The lowest bytes are named AL, BL, CL and 
DL respectively. The higher bytes are named AH, 
BH, CH and DH respectively. The individual byte ac- 
cessibility offers additional flexibility for data opera- 
tions but is not used for effective address calcula- 
tion. 



2.1.1.2 Instruction Pointer 

The instruction pointer, shown in Figure 2.1, is a 
32-bit register named EIP. EIP holds the offset of the 
next instruction to be executed. The offset is always 
relative to the base of the code segment (CS). The 
lower 16 bits (bits 0-15) of the EIP contain the 16-bit 
instruction pointer named IP, which is used for 16-bit 
addressing. 



2.1.1.3 Flags Register 

The flags register is a 32-bit register named 
EFLAGS. The defined bits and bit fields within 
EFLAGS control certain operations and indicate 
status of the Intel486 Microprocessor. The lower 
16 bits (bits 0-15) of EFLAGS contain the 16-bit 
register named FLAGS, which is most useful when 
executing 8086 and 80286 code. EFLAGS is shown 
in Figure 2.2. 



19 



in1el« 



lntel486TM DX MICROPROCESSOR 



Pl^iyE^lOMI^V 



FLAGS 



3322222222221 1 
10987654321098 



111111 
7 6 5 4 3 2 



9876543210 



EFLAGS 



$teS£f?VED FOR mwL 



ALIGNMENT CHECK 

VIRTUAL MODE 

RESUME FLAG 

NESTED TASK FLAG — 
I/O PRIVILEGE LEVEL - 

OVERFLOW 

DIRECTION FLAG 

INTERRUPT ENABLE — 



-CARRY FLAG 
-PARITY FLAG 
-AUXILIARY CARRY 
-ZERO FUG 
-SIGN FLAG 
-TRAP FLAG 



240440-6 



NOTE: 

indicates Intel Reserved: do not define; see Section 2.1.6. 



Figure 2.2. Flags Register 



EFLAGS bits 1, 3, 5, 15 and 19-31 are "undefined". 
When these bits are stored during interrupt process- 
ing or with a PUSHF Instruction (push flags onto 
Stack), a one Is stored in bit 1 and zeros In bits 3, 5, 
15 and 19-31. 

The EFLAGS register in the Intel486 Microprocessor 
contains a new bit not previously defined. The new 
bit, AC, Is defined In the upper 16 bits of the register 
and It enables faults on accesses to misaligned 
data. 

AG (Alignment Check, bit 18) 

The AC bit enables the generation of faults If a 
memory reference Is to a misaligned address. 
Alignment faults are enabled when AC Is set 
to 1 . A mis-aligned address Is a word access 



to an odd address, a dword access to an ad- 
dress that Is not on a dword boundary, or an 
8-byte reference to an address that Is not on a 
64-blt word boundary. See Section 7.1.6 for 
more Information on operand alignment. 

Alignment faults are only generated by pro- 
grams running at privilege level 3. The AC bit 
setting Is Ignored at privilege levels 0, 1 and 2. 
Note that references to the descriptor tables 
(for selector loads), or the task state segment 
(TSS), are implicitly level references even If 
the Instructions causing the references are 
executed at level 3. Alignment faults are re- 
ported through Interrupt 17, with an error code 
of 0. Table 2.1 gives the alignment required 
for the Intel486 microprocessor data types. 



Tabie 2.1. Data Type Alignment Requirements 



Memory Access 


Alignment (Byte Boundary) 


Word 


2 


Dword 


4 


Single Precision Real 


4 


Double Precision Real 


8 


Extended Precision Real 


8 


Selector 


2 


48-Blt Segmented Pointer 


4 


32-Blt Flat Pointer 


4 


32-Blt Segmented Pointer 


2 


48-Blt "Pseudo-Descriptor" 


4 


FSTENV/FLDENV Save Area 


4/2 (On Operand Size) 


FSAVE/FRSTOR Save Area 


4/2 (On Operand Size) 


Bit String 


4 
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IMPLEMENTATION NOTE: 

Several instructions on the Intel486 Microprocessor 
generate misaligned references, even if their mem- 
ory address is aligned. For example, on the In- 
tel486 Microprocessor, the SGDT/SIDT (store glob- 
al/interrupt descriptor table) instruction reads/ 
writes two bytes, and then reads/writes four bytes 
from a "pseudo-descriptor" at the given address. 
The Intel486 Microprocessor will generate misa- 
ligned references unless the address is on a 2 mod 
4 boundary. The FSAVE and FRSTOR instructions 
(floating point save and restore state) will generate 
misaligned references for one-half of the register 
save/restore cycles. The Intel486 Microprocessor 
will not cause any AC faults if the effective address 
given in the instruction has the proper alignment. 

VM (Virtual 8086 Mode, bit 17) 

The VM bit provides Virtual 8086 Mode within 
Protected Mode. If set while the Intel486 Mi- 
croprocessor is in Protected Mode, the In- 
tel486 Microprocessor will switch to Virtual 
8086 operation, handling segment loads as 
the 8086 does, but generating exception 13 
faults on privileged opcodes. The VM bit can 
be set only in Protected Mode, by the I RET 
instruction (if current privilege level = 0) and 
by task switches at any privilege level. The 
VM bit is unaffected by POPF. PUSHF always 
pushes a in this bit, even if executing in Vir- 
tual 8086 Mode. The EFLAGS image pushed 
during interrupt processing or saved during 
task switches will contain a 1 in this bit if the 
interrupted code was executing as a Virtual 
8086 Task. 

RF (Resume Flag, bit 16) 

The RF flag is used in conjunction with the 
debug register breakpoints. It is checked at 
instruction boundaries before breakpoint pro- 
cessing. When RF is set, it causes any debug 
fault to be ignored on the next instruction. RF 
is then automatically reset at the successful 
completion of every instruction (no faults are 
signalled) except the IRET instruction, the 
POPF instruction, (and JMP, CALL, and INT 
instructions causing a task switch). These in- 
structions set RF to the value specified by the 
memory Image. For example, at the end of the 
breakpoint service routine, the IRET instruc- 
tion can pop an EFLAG image having the RF 
bit set and resume the program's execution at 
the breakpoint address without generating an- 
other breakpoint fault on the same location. 

NT (Nested Task, bit 14) 

This flag applies to Protected Mode. NT Is set 
to indicate that the execution of this task is 
nested within another task. If set, it indicates 



that the current nested task's Task State Seg- 
ment (TSS) has a valid back link to the previ- 
ous task's TSS. This bit is set or reset by con- 
trol transfers to other tasks. The value of NT 
in EFLAGS is tested by the IRET instruction to 
determine whether to do an inter-task return 
or an intra-task return. A POPF or an IRET 
instruction will affect the setting of this bit ac- 
cording to the image popped, at any privilege 
level. 

lOPL (Input/Output Privilege Level, bits 12-13) 

This two-bit field applies to Protected Mode. 
lOPL indicates the numerically maximum CPL 
(current privilege level) value permitted to ex- 
ecute I/O instructions without generating an 
exception 13 fault or consulting the I/O Per- 
mission Bitmap. It also indicates the maximum 
CPL value allowing alteration of the IF (INTR 
Enable Flag) bit when new values are popped 
into the EFLAG register. POPF and IRET in- 
struction can alter the lOPL field when execut- 
ed at CPL = 0. Task switches can always al- 
ter the lOPL field, when the new flag image is 
loaded from the incoming task's TSS. 

OF (Overflow Flag, bit 11) 

OF is set if the operation resulted in a signed 
overflow. Signed overflow occurs when the 
operation resulted in carry/borrow into the 
sign bit (high-order bit) of the result but did not 
result in a carry/borrow out of the high-order 
bit, or vice-versa. For 8-, 16-, 32-bit opera- 
tions, OF is set according to overflow at bit 7, 
15, 31, respectively. 

DF (Direction Flag, bit 10) 

DF defines whether ESI and/or EDI registers 
postdecrement or postincrement during the 
string instructions. Postincrement occurs if DF 
is reset. Postdecrement occurs if DF is set. 

IF (INTR Enable Flag, bit 9) 

The IF flag, when set, allows recognition of 
external interrupts signalled on the INTR pin. 
When IF is reset, external interrupts signalled 
on the INTR are not recognized. lOPL indi- 
cates the maximum CPL value allowing altera- 
tion of the IF bit when new values are popped 
into EFLAGS or FLAGS. 

TF (Trap Enable Flag, bit 8) 

TF controls the generation of exception 1 trap 
when single-stepping through code. When TF 
is set, the Intel486 Microprocessor generates 
an exception 1 trap after the next instruction is 
executed. When TF is reset, exception 1 traps 
occur only as a function of the breakpoint ad- 
dresses loaded into debug registers DRO- 
DR3. 
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SF (Sign Flag, bit 7) 

SF is set if the high-order bit of the result is 
set, it is reset otherwise. For 8-, 16-, 32-bit 
operations, SF reflects the state of bit 7, 1 5, 
31 respectively. 

ZF (Zero Flag, bit 6) 

ZF is set if all bits of the result are 0. Other- 
wise it is reset. 

AF (Auxiliary Carry Flag, bit 4) 

The Auxiliary Flag is used to simplify the addi- 
tion and subtraction of packed BCD quanti- 
ties. AF Is set if the operation resulted in a 
carry out of bit 3 (addition) or a borrow into bit 
3 (subtraction). OthenA^ise AF is reset. AF is 
affected by carry out of, or borrow into bit 3 
only, regardless of overall operand length: 8, 
16 or 32 bits. 

PF (Parity Flags, bit 2) 

PF is set if the low-order eight bits of the oper- 
ation contains an even number of "1's" (even 
parity). PF is reset if the low-order eight bits 
have odd parity. PF is a function of only the 
low-order eight bits, regardless of operand 
size. 

CF (Carry Flag, bit 0) 

CF is set if the operation resulted in a carry 
out of (addition), or a borrow into (subtraction) 
the high-order bit. Othen/vise CF is reset. For 
8-, 16- or 32-bit operations, CF is set accord- 
ing to carry/ borrow at bit 7, 15 or 31, respec- 
tively. 



NOTE: 

In these descriptions, "set" means "set to 1," and 
"reset" means "reset to 0." 



2.1.1.4 Segment Registers 

Six 1 6-bit segment registers hold segment selector 
values identifying the currently addressable memory 
segments. In protected mode, each segment may 
range in size from one byte up to the entire linear 
and physical address space of the machine, 4 
Gbytes (232 bytes). In real address mode, the maxi- 
mum segment size is fixed at 64 Kbytes (216 bytes). 

The six addressable segments are defined by the 
segment registers CS, SS, DS, ES, FS and GS. The 
selector in CS indicates the current code segment; 
the selector, in SS indicates the current stack seg- 
ment; the selectors in DS, ES, FS and GS indicate 
the current data segments. 

2.1.1.5 Segment Descriptor Cache Registers 

The segment descriptor cache registers are not pro- 
grammer visible, yet it is very useful to understand 
their content. A programmer invisible descriptor 
cache register is associated with each programmer- 
visible segment register, as shown by Figure 2.3. 
Each descriptor cache register holds a 32-bit base 
address, a 32-bit segment limit, and the other neces- 
sary segment attributes. 
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Figure 2.3. lntel486TM iviicroprocessor Segment Registers and Associated Descriptor Cache Registers 
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When a selector value is loaded into a segment reg- 
ister, the associated descriptor cache register is au- 
tomatically updated with the correct information. In 
Real Address Mode, only the base address is updat- 
ed directly (by shifting the selector value four bits to 
the left), since the segment maximum limit and attri- 
butes are fixed In Real Mode. In Protected Mode, 
the base address, the limit, and the attributes are all 
updated per the contents of the segment descriptor 
indexed by the selector. 

Whenever a memory reference occurs, the segment 
descriptor cache register associated with the seg- 
ment being used is automatically involved with the 
memory reference. The 32-bit segment base ad- 
dress becomes a component of the linear address 
calculation, the 32-bit limit is used for the limit-check 
operation, and the attributes are checked against 
the type of memory reference requested. 

2.1.2 SYSTEM LEVEL REGISTERS 

The system level registers. Figure 2.4, control opera- 
tion of the on-chip cache, the on-chip floating point 



unit (FPU) and the segmentation and paging mecha- 
nisms. These registers are only accessible to pro- 
grams running at privilege level 0, the highest privi- 
lege level. 

The system level registers include three control reg- 
isters and four segmentation base registers. The 
three control registers are CRO, CR2 and CR3. CR1 
is reserved for future Intel processors. The four seg- 
mentation base registers are the Global Descriptor 
Table Register (GDTR), the Interrupt Descriptor Ta- 
ble Register (IDTR), the Local Descriptor Table Reg- 
ister (LDTR) and the Task State Segment Register 
(TR). 



2.1.2.1 Control Registers 
Control Register (CRO) 

CRO, shown in Figure 2.5, contains 1 bits for con- 
trol and status purposes. Five of the bits defined in 
the Intel486 Microprocessor's CRO are newly de- 
fined. The new bits are CD, NW, AM, WP and NE. 
The function of the bits in CRO can be categorized 
as follows: 
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Figure 2.4. System Level Registers 
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Figure 2.5. Control Register 
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Intel486 Microprocessor Operating Modes: PG, PE 
(Table 2.2) 

On-Chip Cache Control Modes: CD, NW (Table 2.3) 

On-Floating Point Unit Control: TS, EM, MP, NE 
(Table 2.4) 

Alignment Check Control: AM 

Supervisor Write Protect: WP 

Table 2.2. Processor Operating Modes 



PG 


PE 


Mode 





1 

1 



1 


1 


REAL Mode. Exact 8086 semantics, 
with 32-bit extensions available with 
prefixes. 

Protected Mode. Exact 80286 
semantics, plus 32-bit extensions 
through both prefixes and "default" 
prefix setting associated with code 
segment descriptors. Also, a sub- 
mode is defined to support a virtual 
8086 within the context of the 
extended 80286 protection model. 

UNDEFINED. Loading CRO with this 
combination of PG and PE bits will 
raise a GP fault with error code 0. 

Paged Protected Mode. All the 
facilities of Protected mode, with 
paging enabled underneath 
segmentation. 



Table 2.3. On-Chip Cache Control Modes 


CD 


NW 


Operating Mode 


1 
1 





1 


1 




Cache fills disabled, write-through and 
invalidates disabled. 

Cache fills disabled, write-through and 
invalidates enabled. 

INVALID. If CRO is loaded with this 
configuration of bits, a GP fault with 
error code is raised. 

Cache fills enabled, write-through and 
invalidates enabled. 



Table 2.4. On-Chip Floating Point Unit Control 



CRO BIT 


Instruction Type 


EM 


TS 


MP 


Floating-Point 


Walt 







1 
1 
1 
1 





1 
1 




1 
1 




1 



1 



1 



1 


Execute 
Execute 
Trap 7 
Trap 7 
Trap 7 
Trap 7 
Trap 7 
Trap 7 


Execute 
Execute 
Execute 
Trap 7 
Execute 
Execute 
Execute 
Trap 7 



The low-order 1 6 bits of CRO are also known as the 
Machine Status Word (MSW), for compatibility with 
the 80286 protected mode. LMSW and SMSW (load 
and store MSW) instructions are taken as special 
aliases of the load and store CRO operations, where 
only the low-order 16 bits of CRO are involved. The 
LMSW and SMSW instructions in the Intel486 micro- 
processor work in an identical fashion to the LMSW 
and SMSW instructions in the 80286 (i.e., they only 
operate on the low-order 16 bits of CRO and ignores 
the new bits). New Intel486 Microprocessor operat- 
ing systems should use the MOV CRO, Reg instruc- 
tion. 

The defined CRO bits are described below. 

PG (Paging Enable, bit 31) 

The PG bit is used to indicate whether paging is 
enabled (PG = 1) or disabled (PG = 0). See Ta- 
ble 2.2. 

CD (Cache Disable, bit 30) 

The CD bit is used to enable the on-chip cache. 
When CD=1, the cache will not be filled on 
cache misses. When CD = 0, cache fills may be 
performed on misses. See Table 2.3. 

The state of the CD bit, the cache enable input 
pin (KEN#), and the relevant page cache dis- 
able (PCD) bit determine if a line read in re- 
sponse to a cache miss will be installed in the 
cache. A line is installed in the cache only if 
CD=0 and KEN# and PCD are both zero. The 
relevant PCD bit comes from either the page 
table entry, page directory entry or control reg- 
ister 3. Refer to Section 5.6 for more details on 
page cacheability. 

CD is set to one after RESET. 

NW (Not Write-Through, bit 29) 

The NW bit enables on-chip cache write- 
throughs and write-invalidate cycles (NW=0). 
When NW=0, all writes, including cache hits, 
are sent out to the pins. Invalidate cycles are 
enabled when NW=0. During an invalidate cy- 
cle a line will be removed from the cache if the 
invalidate address hits in the cache. See Table 
2.3. 

When NW=1, write-throughs and write-lnvali- 
date cycles are disabled. A write will not be sent 
to the pins if the write hits in the cache. With 
NW= 1 the only write cycles that reach the ex- 
ternal bus are cache misses. Write hits with 
NW = 1 will never update main memory. Invali- 
date cycles are ignored when NW= 1. 

AM (Alignment Mask, bit 1 8) 

The AM bit controls whether the alignment 
check (AC) bit in the flag register (EFLAGS) can 
allow an alignment fault. AM = disables the 
AC bit. AM = 1 enables the AC bit. AM = is the 
386 Microprocessor compatible mode. 
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386 Microprocessor software may load incor- 
rect data into the AC bit in the EFLAGS register. 
Setting AM = will prevent AC faults from oc- 
curring before the Intel486 Microprocessor has 
created the AC interrupt service routine. 

WP (Write Protect, bit 16) 

WP protects read-only pages from supervisor 
write access. The 386 Microprocessor allows a 
read-only page to be written from privilege lev- 
els 0-2. The Intel486 Microprocessor Is com- 
patible with the 386 Microprocessor when 
WP = 0. WP = 1 forces a fault on a write to a 
read-only page from any privilege level. Operat- 
ing systems with Copy-on-Write features can be 
supported with the WP bit. Refer to Section 
4.5.3 for further details on use of the WP bit. 

NE (Numerics Exception, bit 5) 

The NE bit controls whether unmasked floating 
point exceptions (UFPE) are handled through 
interrupt vector 16 (NE= 1) or through an exter- 
nal interrupt (NE = 0). NE=0 (default at reset) 
supports the DOS operating system error re- 
porting scheme from the 8087, 80287 and 387 
math coprocessor. In DOS systems, math co- 
processor errors are reported via external inter- 
rupt vector 13. DOS uses interrupt vector 16 for 
an operating system call. Refer to Sections 
6.2.13 and 7.2.14 for more information on float- 
ing point error reporting. 

For any UFPE the floating point error output pin 
(FERR#) will be driven active. 

For NE = 0, the Intel486 Microprocessor works 
in conjunction with the ignore numeric error in- 
put (IGNNE#) and the FERR# output pins. 
When a UFPE occurs and the IGNNE# input Is 
inactive, the Intel486 Microprocessor freezes 
immediately before executing the next floating 
point instruction. An external interrupt controller 
will supply an interrupt vector when FERR# is 
driven active. The UFPE is Ignored if IGNNE# 
is active and floating point execution continues. 

NOTE: 

The freeze does not take place if the next in- 
struction Is one of the control instructions 
FNCLEX, FNINIT, FNSAVE, FNSTENV, 
FNSTCW, FNSTSW, FNSTSW AX, FNENI, 
FNDISI and FNSETPM. The freeze does occur 
if the next instruction is WAIT. 

For NE=1, any UFPE will result in a software 
interrupt 16, immediately before executing the 
next non-control floating point or WAIT instruc- 
tion. The ignore numeric error input (IGNNE#) 
signal will be ignored. 



TS (Task Switched, bit 3) 

The TS bit is set whenever a task switch opera- 
tion is performed. Execution of a floating point 
instruction with TS = 1 will cause a device not 
available (DNA) fault (trap vector 7). If TS = 1 
and MP=1 (monitor coprocessor in CRO) a 
WAIT instruction will cause a DNA fault. See 
Table 2.4. 

EM (Emulate Coprocessor, bit 2) 

The EM bit determines whether floating point 
instructions are trapped (EM = 1 ) or executed. If 
EM = 1 , all floating point instructions will cause 
fault 7. 

NOTE: 

WAIT instructions are not affected by the state 
of EM. See Table 2.4. 

MP (Monitor Coprocessor, bit 1) 

The MP bit is used in conjunction with the TS bit 
to determine If WAIT instructions should trap. If 
MP = 1 and TS=1, WAIT instructions cause 
fault 7. Refer to Table 2.4. The TS bit is set to 1 
on task switches by the Intel486 Microproces- 
sor. Floating point instructions are not affected 
by the state of the MP bit. It is recommended 
that the MP bit be set to one for the normal 
operation of the Intel486 Microprocessor. 

PE (Protection Enable, bit 0) 

The PE bit enables the segment based protec- 
tion mechanism. If PE= 1 protection is enabled. 
When PE = the Intel486 Microprocessor oper- 
ates in REAL mode, with segment based pro- 
tection disabled, and addresses formed as in an 
8086. Refer to Table 2.2. 

All new CRO bits added to the 386 and Intel486 Mi- 
croprocessors, except for ET and NE, are upward 
compatible with the 80286 because they are in reg- 
ister bits not defined in the 80286. For strict compati- 
bility with the 80286, the load machine status word 
(LMSW) instruction is defined to not change the ET 
or NE bits. 

Control Register 1 (CR1) 

CR1 Is reserved for use in future Intel microproces- 
sors. 

Control Register 2 (CR2) 

CR2, shown in Figure 2.6, holds the 32-bit linear ad- 
dress that caused the last page fault detected. The 
error code pushed onto the page fault handler's 
stack when it is invoked provides additional status 
information on this page fault. 
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Figure 2.6. Control Registers 2 and 3 



Control Register 3 (CR3) 



CR3, shown in Figure 2.6, contains the physical 
base address of the page directory table. The In- 
tel486 Microprocessor page directory Is always page 
aligned (4 Kbyte-aligned). This alignment is enforced 
by only storing bits 20-31 in CR3. 

In the Intel486 Microprocessor CR3 contains two 
new bits, page write-through (PWT) (bit 3) and page 
cache disable (PCD) (bit 4).. The page table entry 
(PTE) and page directory entry (PDE) also contain 
PWT and PCD bits. PWT and PCD control page 
cacheability. When a page is accessed In external 
memory, the state of PWT and PCD are driven out 
on the PWT and PCD pins. The source of PWT and 
PCD can be CR3, the PTE or the PDE. PWT and 
PCD are sourced from CR3 when the PDE is being 
updated. When paging is disabled (PG = In CRO), 
PCD and PWT are assumed to be 0, regardless of 
their state in CR3. 

A task switch through a task state segment (TSS) 
which changes the values In CR3, or an explicit load 
into CR3 with any value, will Invalidate all cached 
page table entries in the translation lookaside buffer 
(TLB). 

The page directory base address In CR3 Is a physi- 
cal address. The page directory can be paged out 
while its associated task Is suspended, but the oper- 
ating system must ensure that the page directory is 
resident In physical memory before the task Is dis- 
patched. The entry In the TSS for CR3 has a physi- 
cal address, with no provision for a present bit. This 
means that the page directory for a task must be 
resident in physical memory. The CR3 Image in a 
TSS must point to this area, before the task can be 
dispatched through its TSS. 



2.1.2.2 System Address Registers 

Four special registers are defined to reference the 
tables or segments supported by the 80286, 386 
and Intel486 Microprocessor protection model. 
These tables or segments are: 

GDT (Global Descriptor Table) 
IDT (Interrupt Descriptor Table) 
LDT (Local Descriptor Table) 
TSS (Task State Segment) 

The addresses of these tables and segments are 
stored In special registers, the System Address and 
System Segment Registers, Illustrated in Figure 2.4. 
These registers are named GDTR, IDTR, LDTR and 
TR respectively. Section 4, Protected Mode Archi- 
tecture, describes the use of these registers. 

System Address Registers: GDTR and IDTR 

The GDTR and IDTR hold the 32-blt linear base ad- 
dress and 16-blt limit of the GDT and IDT, respec- 
tively. 

Since the GDT and IDT segments are global to all 
tasks in the system, the GDT and IDT are defined by 
32-blt linear addresses (subject to page translation If 
paging is enabled) and 16-bit limit values. 

System Segment Registers: LDTR and TR 

The LDTR and TR hold the 16-bit selector for the 
LDT descriptor and the TSS descriptor, respectively. 

Since the LDT and TSS segments are task specific 
segments, the LDT and TSS are defined by selector 
values stored in the system segment registers. 

NOTE: 

A programmer-invisible segment descriptor register 
Is associated with each system segment register. 
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2.1.3 FLOATING POINT REGISTERS 

Figure 2.7 shows the floating point register set. The 
on-chip FPU contains eight data registers, a tag 
word, a control register, a status register, an instruc- 
tion pointer and a data pointer. 
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Figure 2.7. Floating Point Registers 

The operation of the Intel486 Microprocessor's on- 
chip floating point unit is exactly the same as the 
387 math coprocessor. Software written for the 387 
math coprocessor will run on the on-chip floating 
point unit (FPU) without any modifications. 



divided into "fields" corresponding to the FPU's ex- 
tended-precision data type. 

The FPU's register set can be accessed either as a 
stack, with instructions operating on the top one or 
two stack elements, or as a fixed register set, with 
instructions operating on explicitly designated regis- 
ters. The TOP field in the status word identifies the 
current top-of-stack register. A "push" operation 
decrements TOP by one and loads a value into the 
new top register. A "pop" operation stores the value 
from the current top register and then increments 
TOP by one. Like other Intel486 microprocessor 
stacks in memory, the FPU register stack grows 
"down" toward lower-addressed registers. 

Instructions may address the data registers either 
implicitly or explicitly. Many instructions operate on 
the register at the TOP of the stack. These instruc- 
tions implicitly address the register at which TOP 
points. Other instructions allow the programmer to 
explicitly specify which register to use. This explicit 
register addressing is also relative to TOP. 

2.1.3.2 Tag Word 

The tag word marks the content of each numeric 
data register, as shown in Figure 2.8. Each two-bit 
tag represents one of the eight data registers. The 
principal function of the tag word is to optimize the 
FPUs performance and stack handling by making it 
possible to distinguish between empty and nonemp- 
ty register locations. It also enables exception han- 
dlers to check the contents of a stack location with- 
out the need to perform complex decoding of the 
actual data. 



2.1.3.1 Data Registers 

Floating point computations use the Intel486 Micro- 
processor's FPU data registers. These eight 80-bit 
registers provide the equivalent capacity of twenty 
32-bit registers. Each of the eight data registers is 



2.1.3.3 Status Word 

The 16-blt status word reflects the overall state of 
the FPU. The status word is shown in Figure 2.9 and 
is located in the status register. 
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Figure 2.8. FPU Tag Word 
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15 



TT 

TOP 

UL 



BUSY 
• TOP OF STACK POINTER 
CONDITION CODE 



ERROR SUMMARY STATUS - 
STACK FLAG - 



EXCEPTION FLAGS: 

PRECISION 

UNDERFLOW 

OVERFLOW 

ZERO DIVIDE 

DENORMALIZED OPERAND 

INVALID OPERATION 



ES is set if any unmasked exception bit is set; cleared othenvise. 
See Table 2.5 for interpretation of condition code. 
TOP values: 

000 = Register is Top of Stack 

001 = Register 1 is Top of Stack 



111 = Register 7 is Top of Stack 
For definitions of exceptions, refer to the Section entitled 
"Exception Handling". 



Figure 2.9. FPU Status Word 



The B bit (Busy, bit 1 5) is included for 8087 compati- 
bility. The B bit reflects the contents of the ES bit (bit 
7 of the Status word). 

Bits 13-11 (TOP) point to the FPU register that is 
the current top-of-stack. 



The four numeric condition code bits, C0-C3, are 
similar to the flags in EFLAGS. Instructions that per- 
form arithmetic operations update C0-C3 to reflect 
the outcome. The effects of these instructions on 
the condition codes are summarized in Tables 2.5 
through 2.8. 
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Table 2.5. FPU Condition Code Interpretation 



Instruction 


CO (8) 


C3(Z) 


C1(A) 


C2(C) 


FPREM, FPREM1 
(see Table 2.3) 


Three least significant bits 
of quotient 
02 QO 


01 
orO/U# 


Reduction 

= complete 

1 = incomplete 


FCOM, FCOMP, 
FCOMPP, FTST, 
FUCOM, FUCOMP, 
FUCOMPP, FICOM, 
FICOMP 


Result of comparison 
(see Table 2.7) 


Zero 
orO/U# 


Operand is not 
comparable 
(Table 2.7) 


FXAM 


Operand class 
(see Table 2.8) 


Sign 
orO/U# 


Operand class 
(Table 2.8) 


FCHS. FABS, FXCH, 
FINCTOP, FDECTOP, 
Constant loads, 
FXTRACT, FLD, 
FILD. FBLD. 
FSTP (ext real) 


UNDEFINED 


Zero 
orO/U# 


UNDEFINED 


FIST, FBSTP, 
FRNDINT, FST, 
FSTP, FADD, FMUL, 
FDIV, FDIVR, 
FSUB, FSUBR, 
FSCALE, FSQRT, 
FPATAN.F2XM1, 
FYL2X, FYL2XP1 


UNDEFINED 


Roundup 
orO/U# 


UNDEFINED 


FPTAN, FSIN 
FCOS. FSINCOS 


UNDEFINED 


Roundup 
orO/U#, 
undefined 
ifC2= 1 


Reduction 

= complete 

1 = Incomplete 


FLDENV, FRSTOR 


Each bit loaded from memory 


FINIT 


Clears these bits 


FLDCW, FSTENV, 
FSTCW, FSTSW, 
FCLEX, FSAVE 


UNDEFINED 


0/U# When both IE and SF bits of status word are set, indicating a stack exception, this bit 
distinguishes between stack overflow (C1 = 1) and underflow (C1 = 0). 

Reduction If FPREM or FPREM 1 produces a remainder that is less than the modulus, reduction is 
complete. When reduction is incomplete the value at the top of the stack is a partial 
remainder, which can be used as input to further reduction. For FPTAN, FSIN, FCOS, and 
FSINCOS, the reduction bit is set if the operand at the top of the stack is too large. In this 
case the original operand remains at the top of the stack. 

Roundup When the PE bit of the status word is set, this bit indicates whether the last rounding in the 
instruction was upward. 

UNDEFINED Do not rely on finding any specific value in these bits. 
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Table 2.6. Condition Code Interpretation after FPREM and FPREMI Instructions 



Condition Code 


interpretation after FPREIVI and FPREMI 


C2 


C3 


C1 


CO 


1 


X 


X 


X 


Incomplete Reduction: 
further interaction required 
for complete reduction 





01 


QO 


02 


QM0D8 


Complete Reduction: 
CO, C3, C1 contain three least 
significant bits of quotient 





1 
1 




1 
1 




1 


1 



1 



1 







1 
1 
1 
1 



1 
2 
3 
4 
5 
6 
7 



Table 2.7. Condition Code Resulting from Comparison 



Order 


C3 


C2 


CO 


TOP > Operand 
TOP < Operand 
TOP = Operand 
Unordered 





1 
1 






1 




1 



1 





Table 2.8. Condition Code Defining Operand Class 


C3 


C2 


CI 


CO 


Value at TOP 














+ Unsupported 













+ NaN 













- Unsupported 












- NaN 





1 








+ Normal 





1 







+ Infinity 





1 







— Normal 





1 






- Infinity 













+ 












+ Empty 












-0 











- Empty 




1 








+ Denormal 




1 


1 





- Denormal 
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Bit 7 is the error summary (ES) status bit. The ES bit 
is set if any unmasked exception bit (bits 0-5 in the 
status word) is set; ES Is clear otherwise. The 
FERR# (floating point error) signal is asserted when 
ES is set. 

Bit 6 is the stack flag (SF). This bit is used to distin- 
guish invalid operations due to stack overflow or un- 
derflow. When SF is set, bit 9 (C1) distinguishes be- 
tween stack overflow (C1 = 1) and underflow 
(C1=0). 

Table 2.9 shows the six exception flags in bits 0-5 
of the status word. Bits 0-5 are set to indicate that 
the FPU has detected an exception while executing 
an instruction. 

The six exception flags in the status word can be 
individually masked by mask bits in the FPU control 
word. Table 2.9 lists the exception conditions, and 
their causes in order of precedence. Table 2.9 also 
shows the action taken by the FPU if the corre- 
sponding exception flag Is masked. 

An exception that is not masked by the control word 
will cause three things to happen: the corresponding 
exception flag In the status word will be set, the ES 
bit in the status word will be set and the FERR# 
output signal will be asserted. When the Intel486 Mi- 
croprocessor attempts to execute another floating 
point or WAIT instruction, exception 16 occurs or an 
external interrupt happens if the NE=1 in control 



register 0. The exception condition must be resolved 
via an interrupt service routine. The FPU saves the 
address of the floating point Instruction that caused 
the exception and the address of any memory oper- 
and required by that instruction in the instruction and 
data pointers (see Section 2.1.3.4). 

Note that when a new value is loaded into the status 
word by the FLDENV (load environment) or 
FRSTOR (restore state) instruction, the value of ES 
(bit 7) and its reflection In the B bit (bit 15) are not 
derived from the values loaded from memory. The 
values of ES and B are dependent upon the values 
of the exception flags in the status word and their 
corresponding masks in the control word. If ES is set 
in such a case, the FERR# output of the Intel486 
Microprocessor is activated Immediately. 



2.1.3.4 Instruction and Data Pointers 

Because the FPU operates in parallel with the ALU 
(in the Intel486 microprocessor the arithmetic and 
logic unit (ALU) consists of the base architecture 
registers), any errors detected by the FPU may be 
reported after the ALU has executed the floating 
point instruction that caused it. To allow identifica- 
tion of the failing numeric instruction, the Intel486 
Microprocessor contains two pointer registers that 
supply the address of the failing numeric instruction 
and the address of its numeric memory operand (if 
appropriate). 



Table 2.9. FPU Exceptions 



Exception 


Cause 


Default Action 
(if exception is masked) 


Invalid 
Operation 


Operation on a signaling NaN, unsupported format, 
indeterminate form (0*oo, 0/0, (+°°) + (-°^), etc.), or 
stack overflow/underflow (SF is also set). 


Result is a quiet NaN, integer 
indefinite, or BCD indefinite 


Denormalized 
Operand 


At least one of the operands is denormalized, I.e., it has 
the smallest exponent but a nonzero significand. 


Normal processing 
continues 


Zero Divisor 


The divisor is zero while the dividend is a noninfinite, 
nonzero number. 


Result is oo 


Overflow 


The result is too large in magnitude to fit in the specified 
format. 


Result is largest finite value 
or oo 


Underflow 


The true result is nonzero but too small to be 
represented in the specified format, and, if underflow 
exception is masked, denormalization causes loss of 
accuracy. 


Result is denormalized or 
zero 


Inexact 

Result 

(Precision) 


The true result is not exactly representable in the 
specified format (e.g., 1 /3); the result is rounded 
according to the rounding mode. 


Normal processing 
continues 
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The instruction and data pointers are provided for 
user-written error handlers. These registers are ac- 
cessed by the FLDENV (load environment), 
FSTENV (store environment), FSAVE (save state) 
and FRSTOR (restore state) instructions. Whenever 
the Intel486 Microprocessor decodes a new floating 
point instruction, it saves the instruction (including 
any prefixes that may be present), the address of 
the operand (if present) and the opcode. 

The instruction and data pointers appear in one of 
four formats depending on the operating mode of 
the Intel486 Microprocessor (protected mode or 
real-address mode) and depending on the 



operand-size attribute in effect (32-bit operand or 
16-bit operand). When the Intel486 Microprocessor 
is in the virtual-86 mode, the real address mode for- 
mats are used. The four formats are shown in Fig- 
ures 2.10-2.13. The floating point instructions 
FLDENV, FSTENV, FSAVE and FRSTOR are used 
to transfer these values to and from memory. Note 
that the value of the data pointer is undefined if the 
prior floating point instruction did not have a memory 
operand. 

NOTE: 

The operand size attribute is the D bit in a segment 
descriptor. 
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Figure 2.10. Protected Mode FPU Instruction and Data Pointer Image In Memory, 32-Bit Format 
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Figure 2.11. Real Mode FPU Instruction and Data Pointer Image In Memory, 32-Bit Format 
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Figure 2.12. Protected Mode FPU 

Instruction and Data Pointer 
Image in Memory, 16-Bit Format 
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Figure 2.13. Real Mode FPU 

Instruction and Data Pointer 

Image In Memory, 16-Bit Format 



2.1.3.5 FPU Control Word 

The FPU provides several processing options that are selected by loading a control word from memory into 
the control register. Figure 2.14 shows the format and encoding of fields in the control word. 



15 



n 

XXX 



RESERVED 
RESERVED* 
ROUNDING CONTROL 
PRECISION CONTROL 



X X 

Lr 



RESERVED 

EXCEPTION MASKS: 

PRECISION 

UNDERFLOW 

OVERFLOW 

ZERO DIVIDE 

DENORMALIZED OPERAND 

INVALID OPERATION 



♦ "0" AFTER RESET OR FINIT; 
CHANGEABLE UPON LOADING THE 
CONTROL WORD (CW). PROGRAMS 
MUST IGNORE THIS BIT. 



Precision Control 

00 — 24 bits (single precision) 
01 — (reserved) 

1 — 53 bits (double precision) 
11—64 bits (extended precision) 



Rounding Control 

00 — Round to nearest or even 
01 — Round down (toward — «>) 
10— Round up (toward + «>) 
11 — Chop (truncate toward zero) 



Figure 2.14- FPU Control Word 
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The low-order byte of the FPU control word config- 
ures the FPU error and exception masking. Bits 0-5 
of the control word contain Individual masks for each 
of the six exceptions that the FPU recognizes. 

The high-order byte of the control word configures 
the FPU operating mode, including precision and 
rounding. 

RC (Rounding Control, bits 10-11) 

The RC bits provide for directed rounding and 
true chop, as well as the unbiased round to 
nearest even mode specified in the IEEE stan- 
dard. Rounding control affects only those in- 
structions that perform rounding at the end of 
the operation (and thus can generate a preci- 
sion exception); namely, FST, FSTP, FIST, all 
arithmetic instructions (except FPREM, 
FPREM1, FXTRACT, FABS and FCHS), and all 
transcendental instructions. 

PC (Precision Control, bits 8-9) 

The PC bits can be used to set the FPU internal 
operating precision of the significand at less 
than the default of 64 bits (extended precision). 
This can be useful in providing compatibility with 
early generation arithmetic processors of small- 
er precision. PC affects only the instructions 
ADD, SUB, DIV, MUL, and SQRT. For all other 
instructions, either the precision is determined 
by the opcode or extended precision is used. 

2.1.4 DEBUG AND TEST REGISTERS 

2.1.4.1 Debug Registers 

The six programmer accessible debug registers. Fig- 
ure 2.15, provide on-chip support for debugging. De- 
bug registers DRO-3 specify the four linear break- 
points. The Debug control register DR7, is used to 
set the breakpoints and the Debug Status Register, 
DR6, displays the current state of the breakpoints. 
The use of the Debug registers is described in Sec- 
tion 9. 





Debug Registers 


DRO 
DR1 
DR2 
DR3 
DR4 
DR5 
DR6 
DR7 

TR3 
TR4 
TR5 
TR6 
TR7 




LINEAR BREAKPOINT ADDRESS 


LINEAR BREAKPOINT ADDRESS 1 


LINEAR BREAKPOINT ADDRESS 2 


LINEAR BREAKPOINT ADDRESS 3 


Intel Reserved Do Not Define 


Intel Reserved Do Not Define 


BREAKPOINT STATUS 


BREAKPOINT CONTROL 




Test Registers 




CACHE TEST DATA 


CACHE TEST STATUS 


CACHE TEST CONTROL 


TLB TEST CONTROL 


TLB TEST STATUS 




TLB = Translation Lookaside Buffer 



Figure 2.15 

2.1.4.2 Test Registers 

The Intel486 Microprocessor contains five test regis- 
ters. The test registers are shown in Figure 2.15. 
TR6 and TR7 are used to control the testing of the 
translation lookaside buffer. TR3, TR4 and TR5 are 
used for testing the on-chip cache. The use of the 
test registers is discussed in Section 8. 

2.1.5 REGISTER ACCESSIBILITY 

There are a few differences regarding the accessibil- 
ity of the registers in Real and Protected Mode. Ta- 
ble 2.10 summarizes these differences. See Section 
4, Protected Mode Architecture, for further details. 
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Table 2.10. Register Usage 


Register 


Use in 
Real Mode 


Use in 
Protected l\^ode 


Use in 
Virtual 8086 l\/lode 


Load 


Store 


Load 


Store 


Load 


Store 


General Registers 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


Segment Register 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


Flag Register 


Yes 


Yes 


Yes 


Yes 


lOPL 


lOPL* 


Control Registers 


Yes 


Yes 


PL = 


PL = 


No 


Yes 


GDTR 


Yes 


Yes 


PL = 


Yes 


No 


Yes 


IDTR 


Yes 


Yes 


PL = 


Yes 


No 


Yes 


LDTR 


No 


No 


PL = 


Yes 


No 


No 


TR 


No 


No 


PL = 


Yes 


No 


No 


FPU Data Registers 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


FPU Control Registers 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


FPU Status Registers 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


FPU Instruction Pointer 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


FPU Data Pointer 


Yes 


Yes 


Yes 


Yes 


Yes 


Yes 


Debug Registers 


Yes 


Yes 


PL = 


PL = 


No 


No 


Test Registers 


Yes 


Yes 


PL = 


PL = 


No 


No 



NOTES: 

PL = 0: The registers can be accessed only when the current privilege level is zero. 

*IOPL: The PUSHF and POPF instructions are made I/O Privilege Level sensitive in Virtual 86 Mode. 



2.1.6 COMPATIBILITY 

VERY IMPORTANT NOTE: 
COMPATIBILITY WITH FUTURE PROCESSORS 

In the preceding register descriptions, note cer- 
tain Intel486 Microprocessor register bits are 
Intel reserved. When reserved bits are called 
out, treat them as fully undefined. This is essen- 
tial for your software compatibility with future 
processors! Follow the guidelines below: 

1) Do not depend on the states of any unde- 
fined bits when testing the values of defined 
register bits. Mask them out when testing. 

2) Do not depend on the states of any unde- 
fined bits when storing them to memory or 
another register. 



3) Do not depend on the ability to retain infor- 
mation written into any undefined bits. 

4) When loading registers always load the unde- 
fined bits as zeros. 

5) However, registers which have been previ- 
ously stored may be reloaded without mask- 
ing. 

Depending upon the values of undefined regis- 
ter bits will make your software dependent upon 
the unspecified Intel486 Microprocessor han- 
dling of these bits. Depending on undefined val- 
ues risks making your software incompatible 
with future processors that define usages for 
the Intel486 Microprocessor-undefined bits. 
AVOID ANY SOFTWARE DEPENDENCE UPON 
THE STATE OF UNDEFINED Intel486 MICRO- 
PROCESSOR REGISTER BITS. 
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2.2 Instruction Set 

The Intel486 Microprocessor instruction set can be 
divided into 1 1 categories of operations: 

Data Transfer 

Arithmetic 

Shift/Rotate 

String Manipulation 

Bit Manipulation 

Control Transfer 

High Level Language Support 

Operating System Support 

Processor Control 

Floating Point 

Floating Point Control 

The Intel486 Microprocessor instructions are listed 
in Section 10. Note that all floating point unit instruc- 
tion mnemonics begin with an F. 

All Intel486 Microprocessor instructions operate on 
either 0, 1 , 2 or 3 operands; where an operand re- 
sides in a register, in the instruction itself or in mem- 
ory. Most zero operand instructions (e.g., CLI, STI) 
take only one byte. One operand instructions gener- 
ally are two bytes long. The average instruction is 
3.2 bytes long. Since the Intel486 Microprocessor 
has a 32-byte instruction queue, an average of 10 
instructions will be prefetched. The use of two oper- 
ands permits the following types of common instruc- 
tions: 

Register to Register 
Memory to Register 
Memory to Memory 
Immediate to Register 
Register to Memory 
Immediate to Memory 

The operands can be either 8, 16, or 32 bits long. As 
a general rule, when executing code written for the 
Intel486 or 386 Microprocessors (32-bit code), oper- 
ands are 8 or 32 bits; when executing existing 80286 
or 8086 code (16-bit code), operands are 8 or 16 
bits. Prefixes can be added to all instructions which 
override the default length of the operands (i.e., use 
32-bit operands for 16-bit code, or 16-bit operands 
for 32-bit code). 



2.3 Memory Organization 



Introduction 

Memory on the Intel486 Microprocessor is divided 
up into 8-bit quantities (bytes), 16-bit quantities 
(words), and 32-bit quantities (dwords). Words are 
stored In two consecutive bytes in memory with the 
low-order byte at the lowest address, the high order 



byte at the high address. Dwords are stored in four 
consecutive bytes in memory with the low-order byte 
at the lowest address, the high-order byte at the 
highest address. The address of a word or dword is 
the byte address of the low-order byte. 

In addition to these basic data types, the Intel486 
Microprocessor supports two larger units of memory: 
pages and segments. Memory can be divided up 
into one or more variable length segments, which 
can be swapped to disk or shared between pro- 
grams. Memory can also be organized into one or 
more 4 Kbyte pages. Finally, both segmentation and 
paging can be combined, gaining the advantages of 
both systems. The Intel486 Microprocessor sup- 
ports both pages and segments in order to provide 
maximum flexibility to the system designer. Segmen- 
tation and paging are complementary. Segmentation 
is useful for organizing memory in logical modules, 
and as such is a tool for the application programmer, 
while pages are useful for the system programmer 
for managing the physical memory of a system. 

2.3.1 ADDRESS SPACES 

The Intel486 Microprocessor has three distinct ad- 
dress spaces: logical, linear, and physical. A logi- 
cal address (also known as a virtual address) con- 
sists of a selector and an offset. A selector is the 
contents of a segment register. An offset is formed 
by summing all of the addressing components 
(BASE, INDEX, DISPLACEMENT) discussed in Sec- 
tion 2.5.3 Memory Addressing Modes into an ef- 
fective address. Since each task on the Intel486 Mi- 
croprocessor has a maximum of 16K (214 — 1) se- 
lectors, and offsets can be 4 gigabytes, (232 bits) 
this gives a total of 246 bits or 64 terabytes of logi- 
cal address space per task. The programmer sees 
this virtual address space. 

The segmentation unit translates the logical ad- 
dress space into a 32-bit linear address space. If the 
paging unit is not enabled then the 32-bit linear ad- 
dress corresponds to the physical address. The 
paging unit translates the linear address space into 
the physical address space. The physical address 
is what appears on the address pins. 

The primary difference between Real Mode and Pro- 
tected Mode is how the segmentation unit performs 
the translation of the logical address into the linear 
address. In Real Mode, the segmentation unit shifts 
the selector left four bits and adds the result to the 
offset to form the linear address. While jn Protected 
Mode every selector has a linear base address as- 
sociated with it. The linear base address is stored in 
one of two operating system tables (i.e., the Local 
Descriptor Table or Global Descriptor Table). The 
selector's linear base address is added to the offset 
to form the final linear address. 
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Figure 2.16. Address Translation 



Figure 2.16 shows the relationship between the vari- 
ous address spaces. 

2.3.2 SEGIVIENT REGISTER USAGE 

The main data structure used to organize memory is 
the segment. On the Intel486 Microprocessor, seg- 
ments are variable sized blocks of linear addresses 
which have certain attributes associated with them. 
There are two main types of segments: code and 
data, the segments are of variable size and can be 
as small as 1 byte or as large as 4 gigabytes (232 
bytes). 

In order to provide compact instruction encoding, 
and increase processor performance, instructions 
do not need to explicitly specify which segment reg- 
ister is used. A default segment register is automati- 
cally chosen according to the rules of Table 2.11 
(Segment Register Selection Rules). In general, data 
references use the selector contained in the DS reg- 
ister; Stack references use the SS register and In- 
struction fetches use the CS register. The contents 
of the Instruction Pointer provide the offset. Special 
segment override prefixes allow the explicit use of a 
given segment register, and override the implicit 
n^les listed in Table 2.1 1. The override prefixes also 
allow the use of the ES, FS and GS segment regis- 
ters. 

There are no restrictions regarding the overlapping 
of the base addresses of any segments. Thus, all 6 
segments could have the base address set to zero 



and create a system with a four gigabyte linear ad- 
dress space. This creates a system where the virtual 
address space is the same as the linear address 
space. Further details of segmentation are dis- 
cussed in Section 4.1. 



2.4 I/O Space 

The Intel486 Microprocessor has two distinct physi- 
cal address spaces: Memory and I/O. Generally, pe- 
ripherals are placed in I/O space although the In- 
tel486 Microprocessor also supports memory- 
mapped peripherals. The I/O space consists of 
64 Kbytes, it can be divided into 64K 8-bit ports, 32K 
16-bit ports, or 16K 32-bit ports, or any combination 
of ports which add up to less than 64 Kbytes. The 
64K I/O address space refers to physical memory 
rather than linear address since I/O instructions do 
not go through the segmentation or paging hard- 
ware. The M/IO# pin acts as an additional address 
line thus allowing the system designer to easily de- 
termine which address space the processor is ac- 
cessing. 

The I/O ports are accessed via the IN and OUT I/O 
instructions, with the port address supplied as an 
immediate 8-bit constant in the instruction or in the 
DX register. All 8- and 16-bit port addresses are zero 
extended on the upper address lines. The I/O in- 
structions cause the M/IO# pin to be driven low. 

I/O port addresses 00F8H through OOFFH are re- 
served for use by Intel. 
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Table 2. 11. Segment Register Selection Rules 



Type of 
Memory Reference 


implied (Default) 
Segment Use 


Segment Override 
Prefixes Possible 


Code Fetch 


CS 


None 


Destination of PUSH, PUSHF, INT, 
CALL, PUSHA Instructions 


ss 


None 


Source of POP, POPA, POPF, 
IRET, RET instructions 


ss 


None 


Destination of STOS, MOVS, REP 
STOS, REP MOVS Instructions 
(Dl is Base Register) 


ES 


None 


Other Data References, with 
Effective Address Using Base 
Register of: 

[EAX] 

[EBX] 

[ECX] 

[EDX] 

[ESI] 

[EDI] 

[EBP] 

[ESP] 


DS 
DS 
DS 
DS 
DS 
DS 
SS 
SS 


All 



2.5 Addressing Modes 

2.5.1 ADDRESSING MODES OVERVIEW 

The Intel486 Microprocessor provides a total of 1 1 
addressing modes for instructions to specify oper- 
ands. The addressing modes are optimized to allow 
the efficient execution of high level languages such 
as C and FORTRAN, and they cover the vast majori- 
ty of data references needed by high-level lan- 
guages. 

2.5.2 REGISTER AND IIVIIVIEDIATE MODES 

Two of the addressing modes provide for instruc- 
tions that operate on register or immediate oper- 
ands: 

Register Operand Mode: The operand is located in 
one of the 8-, 1 6- or 32-bit general registers. 

Immediate Operand Mode: The operand is includ- 
ed in the instruction as part of the opcode. 



2.5.3 32-BIT MEMORY ADDRESSING MODES 

The remaining 9 modes provide a mechanism for 
specifying the effective address of an operand. The 
linear address consists of two components: the seg- 
ment base address and an effective address. The 
effective address is calculated by using combina- 
tions of the following four address elements: 

DISPLACEMENT: An 8-, or 32-bit immediate value, 
following the instruction. 

BASE: The contents of any general purpose regis- 
ter. The base registers are generally used by compil- 
ers to point to the start of the local variable area. 

INDEX: The contents of any general purpose regis- 
ter except for ESP. The index registers are used to 
access the elements of an array, or a string of char- 
acters. 

SCALE: The index register's value can be multiplied 
by a scale factor, either 1, 2, 4 or 8. Scaled index 
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mode is especially useful for accessing arrays or 
structures. 

Combinations of these 4 components make up the 9 
additional addressing modes. There is no perform- 
ance penalty for using any of these addressing com- 
binations, since the effective address calculation is 
pipelined with the execution of other instructions. 
The one exception is the simultaneous use of Base 
and Index components which requires one addition- 
al clock. 

As shown in Figure 2.17, the effective address (EA) 
of an operand is calculated according to the follow- 
ing formula. 

EA=Base Reg + (Index Reg * Scaling) + Displacement 

Direct Mode: The operand's offset is contained as 
part of the instruction as an 8-, 16- or 32-bit dis- 
placement. 
EXAMPLE: INC Word PTR [500] 

Register Indirect Mode: A BASE register contains 
the address of the operand. 
EXAMPLE: MOV [ECX], EDX 



Based Mode: A BASE register's contents is added 
to a DISPLACEMENT to form the operand's offset. 
EXAMPLE: MOV ECX, [EAX + 24] 

Index Mode: An INDEX register's contents is added 
to a DISPLACEMENT to form the operand's offset. 
EXAMPLE: ADD EAX, TABLE[ESI] 

Scaled Index Mode: An INDEX register's contents is 
multiplied by a scaling factor which is added to a 
DISPLACEMENT to form the operand's offset. 
EXAMPLE: IMUL EBX, TABLE[ESIM],7 

Based Index Mode: The contents of a BASE register 
is added to the contents of an INDEX register to 
form the effective address of an operand. 
EXAMPLE: MOV EAX, [ESI] [EBX] 

Based Scaled Index Mode: The contents of an IN- 
DEX register is multiplied by a SCALING factor and 
the result is added to the contents of a BASE regis- 
ter to obtain the operand's offset. 
EXAMPLE: MOV ECX, [EDX*8] [EAX] 
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Figure 2.17. Addressing Mode Caiculations 
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Based Index Mode with Displacement: The contents 
of an INDEX Register and a BASE register's con- 
tents and a DISPLACEMENT are all summed to- 
gether to form the operand offset. 
EXAMPLE: ADD EDX, [ESI] [EBP + OOFFFFFOH] 

Based Scaled Index Mode with Displacement: The 
contents of an INDEX register are multiplied by a 
SCALING factor, the result is added to the contents 
of a BASE register and a DISPLACEMENT to form 
the operand's offset. 

EXAMPLE: MOV EAX, L0CALTABLE[EDI*4] 
[EBP + 80] 



Address Length Prefix since, with D = 
addressing mode is 16-bits. 



= 0, the default 



2.5.4 



DIFFERENCES BETWEEN 16- AND 32-BIT 
ADDRESSES 



In order to provide software compatibility with the 
80286 and the 8086, the Intel486 Microprocessor 
can execute 16-bit instructions in Real and Protect- 
ed Modes. The processor determines the size of the 
instructions it is executing by examining the D bit in 
the CS segment Descriptor. If the D bit is then all 
operand lengths and effective addresses are as- 
sumed to be 1 6 bits long. If the D bit is 1 then the 
default length for operands and addresses is 32 bits. 
In Real Mode the default size for operands and ad- 
dresses is 1 6-blts. 

Regardless of the default precision of the operands 
or addresses, the Intel486 Microprocessor is able to 
execute either 16- or 32-bit instructions. This is 
specified via the use of override prefixes. Two prefix- 
es, the Operand Size Prefix and the Address 
Length Prefix, override the value of the D bit on an 
individual instruction basis. These prefixes are auto- 
matically added by Intel assemblers. 

Example: The processor is executing in Real Mode 
and the programmer needs to access the EAX regis- 
ters. The assembler code for this might be MOV 
EAX, 32-bit MEMORYOP, ASM486 Macro Assem- 
bler automatically determines that an Operand Size 
Prefix is needed and generates it. 

Example: The D bit is 0, and the programmer wishes 
to use Scaled Index addressing mode to access an 
array. The Address Length Prefix allows the use of 
MOV DX, TABLE [ESI *2]. The assembler uses an 



Example: The D bit is 1 , and the program wants to 
store a 1 6-bit quantity. The Operand Length Prefix is 
used to specify only a 16-bit value; MOV MEM16, 
DX. 

The OPERAND LENGTH and Address Length Pre- 
fixes can be applied separately or in combination to 
any instruction. The Address Length Prefix does not 
allow addresses over 64 Kbytes to be accessed in 
Real Mode. A memory address which exceeds 
FFFFH will result in a General Protection Fault. An 
Address Length Prefix only allows the use of the ad- 
ditional Intel486 Microprocessor addressing modes. 

When executing 32-blt code, the Intel486 Microproc- 
essor uses either 8-, or 32-bit displacements, and 
any register can be used as base or index registers. 
When executing 1 6-bit code, the displacements are 
either 8, or 1 6 bits, and the base and index register 
conform to the 80286 model. Table 2.12 illustrates 
the differences. 



2.6 Data Formats 

2.6.1 DATA TYPES 

The Intel486 Microprocessor can support a wide va- 
riety of data types. In the following descriptions, the 
on-chip floating point unit (FPU) consists of the float- 
ing point registers. The central processing unit 
(CPU) consists of the base architecture registers. 

2.6.1.1 Unsigned Data Types 

The FPU does not support unsigned data types. Re- 
fer to Table 2.1 3. 

Byte: Unsigned 8-bit quantity 

Word: Unsigned 16-bit quantity 

Dword: Unsigned 32-bit quantity 

The least significant bit (LSB) in a byte is bit 0, and 
the most significant bit is 7. 



Table 2.12. BASE and INDEX Registers for 16 


- and 32-Bit Addresses 




16-Bit Addressing 


32-Bit Addressing 


BASE REGISTER 


BX,BP 


Any 32-bit GP Register 


INDEX REGISTER 


SI.DI 


Any 32-bit GP Register 
Except ESP 


SCALE FACTOR 


none 


1,2,4,8 


DISPLACEMENT 


0,8, 16 bits 


0, 8, 32 bits 
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2.6.1.2 Signed Data Types 

All signed data types assume 2's complement nota- 
tion. The signed data types contain two fields, a sign 
bit and a magnitude. The sign bit is the most signifi- 
cant bit (MSB). The number is negative if the sign bit 
is 1 . If the sign bit is 0, the number is positive. The 
magnitude field consists of the remaining bits in the 
number. Refer to Table 2.13. 

8-bit Integer: Signed 8-bit quantity 

16-bit Integer: Signed 1 6-bit quantity 

32-bit Integer: Signed 32-bit quantity 

64-bit Integer: Signed 64-bit quantity 

The FPU only supports 16-, 32- and 64-bit integers. 
The CPU only supports 8-, 1 6- and 32-bit integers. 

2.6.1.3 Floating Point Data Types 

Floating point data type in the Intel486 Microproces- 
sor contain three fields, sign, signlficand and expo- 
nent. The sign field is one bit and is the MSB of the 
floating point number. The number is negative if the 
sign bit is 1. If the sign bit is 0, the number is posi- 
tive. The signlficand gives the significant bits of the 
number. The exponent field contains the power of 2 
needed to scale the signlficand. Refer to Table 2.13. 

Only the FPU supports floating point data types. 

Single Precision Real: 23-bit signlficand and 8- 
bit exponent. 32 bits total. 

Double Precision Real: 52-bit signlficand and li- 
bit exponent. 64 bits total. 

Extended Precision Real: 64-bit signlficand and 15- 
bit exponent. 80 bits total. 



2.6.1.4 BCD Data Types 

The Intel486 Microprocessor supports packed and 
unpacked binary coded decimal (BCD) data types. A 
packed BCD data type contains two digits per byte, 
the lower digit is in bits 0-3 and the upper digit in 
bits 4-7. An unpacked BCD data type contains 1 
digit per byte stored in bits 0-3. 

The CPU supports 8-bit packed and unpacked BCD 
data types. The FPU only supports 80-bit packed 
BCD data types. Refer to Table 2.13. 



2.6.1.5 String Data Types 

A string data type is a contiguous sequence of bits, 
bytes, words or dwords. A string may contain be- 
tween 1 byte and 4 Gbytes. Refer to Table 2.14. 

String data types are only supported by the CPU. 

Byte String: Contiguous sequence of bytes. 

Word String: Contiguous sequence of words. 

Dword String: Contiguous sequence of dwords. 

Bit String: A set of contiguous bits. In the Intel486 
Microprocessor bit strings can be up to 4 gigabits 
long. 

2.6.1.6 ASCII Data Types 

The Intel486 Microprocessor supports ASCII (Ameri- 
can Standard Code for Information Interchange) 
strings and can perform arithmetic operations (such 
as addition and division) on ASCII data. Refer to Ta- 
ble 2.14. 
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Table 2.13. lntel486TM Microprocessor Data Types 



Supported by Supported by 
Base Registers FPU 
i i 



Least Significant Byte 
i 



Data Format 






Range 


Precision 


7 7 


7 7 7 


7 


7 7 


7 


7 





Byte 
Word 
Dword 
8-Bit Integer 
16-Bit Integer 
32-Bit Integer 
64-Bit Integer 
8-Bit Unpacked BCD 
8-Bit Packed BCD 
80-Bit Packed BCD 
Single Precision Real 
Double Precision Real 
Extended Precision Real 


X 
X 
X 
X 
X 
X 

X 
X 


X 
X 
X 

X 
X 
X 
X 


0-255 
0-64K 
0-4G 

102 

10^ 

109 

10^9 

0-9 

0-9 

±10±1« 
±10±38 

±10±308 

±10±4932 


8 bits 
16 bits 
32 bits 
8 bits 
16 bits 
32 bits 
64 bits 

1 Digit 

2 Digits 
18 Digits 
24 Bits 
53 Bits 
64 Bits 




7 











15 













31 















7 





Two's 
Complement 








Sign Bit T 
15 





Two's 
Complement 








Sign Bit 
31 


T 





Two's 
Complement 








Sign Bit T 
63 





Two's 
Complement 






Sign Bit 


T 


7 





One BCD Digit per Byte 






7 





Two BCD Digits per Byte 




79 72 









Ignored 




t Sign Bit 


31 23 









Biased 
Exp. 


Significand 




Sign Bit 
63 52 


T 









Biased 
Exp. 


Significand 


Sign Bit 
79 


T 
63 







Biased 
Exp. 


^ Significand 


T Sign Bit 
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Table 2.14. String and ASCII Data Types 



Byte String 



Word String 



String Data Types 

Address 



A+2N+1 A+2N 
1 



A + N 




A+1 


A 


N 
7 


• • • 


1 
7 



7 



A+3 


A+2 


A+1 




A 




15 





15 











Dword 
String 



A+4N+3 A+4N+2 A+4N+1 A+4N 
' 1 ^ 



A+7 


A+6 


A+5 


A + 4 


A+3 


A+2 A+1 


A 




31 









31 











A + 268,435,455 
I 



A+3 A+2 A+1 A A-1 A-2 A-3 



A -268,435,456 
i 



Bit 
String 



7 07 \ \ 7 07 07 07 ...1 07 07 07 \ \ 7 07 



+ 2,147.483,647 



T T T 

+ 7 +1 



-2,147,483,648 



ASCII Data Types 



ASCII Character 



2.6.1.7 Pointer Data Types 

A pointer data type contains a value that gives the 
address of a piece of data. The Intel486 Microproc- 
essor supports two types of pointers. Refer to Table 
2.15. 

48-bit Pointer: 16-bit selector and 32-blt offset 

32-bit Pointer: 32-bit offset 



Table 2.15. Pointer Data Types 



Least Sig Byte 
i 



Data Format 






















48-Bit Pointer 
32-Bit Pointer 




47 31 









Selector 


Offset 






31 









Offset 
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2.6.2 



LITTLE ENDIAN vs BIG ENDIAN 
DATA FORMATS 



The Intel486 Microprocessor, as well as all other 
members of the 86 architecture use the "little-endi- 
an" method for storing data types that are larger 
than one byte. Words are stored in two consecutive 
bytes in memory with the low-order byte at the low- 
est address and the high order byte at the high ad- 
dress. Dwords are stored in four consecutive bytes 
in memory with the low-order byte at the lowest ad- 
dress and the high order byte at the highest address. 
The address of a word or dword data item is the byte 
address of the low-order byte. 

Figure 2.18 illustrates the differences between the 
big-endian and little-endian formats for dwords. The 
32 bits of data are shown with the low order bit num- 
bered bit and the high order bit numbered 32. Big- 
endian data is stored with the high-order bits at the 
lowest addressed byte. Little-endian data is stored 
with the high-order bits In the highest addressed 
byte. 

The Intel486 Microprocessor has two instructions 
which can convert 16- or 32-bit data between the 
two byte orderings. BSWAP (byte swap) handles 
four byte values and XCHG (exchange) handles two 
byte values. 



m+3 m+2 m+1 m 
31 24 23 16 15 8 7 


1 


Dword In Little-Endian Memory Format 

m m+1 m+2 m+3 
31 24 23 16 15 8 7 


1 1 



Dword in Big-Endian Memory Format 



Figure 2.18. Big vs Little Endian Memory Format 



2.7 Interrupts 

2.7.1 INTERRUPTS AND EXCEPTIONS 

Interrupts and exceptions alter the normal program 
flow, in order to handle external events, to report 
errors or exceptional conditions. The difference be- 
tween Interrupts and exceptions is that interrupts are 
used to handle asynchronous external events while 
exceptions handle instruction faults. Although a pro- 
gram can generate a software interrupt via an INT N 
instruction, the processor treats software interrupts 
as exceptions. 



Hardware interrupts occur as the result of an exter- 
nal event and are classified into two types: maskable 
or non-maskable. Interrupts are serviced after the 
execution of the current instruction. After the inter- 
rupt handler is finished servicing the interrupt, exe- 
cution proceeds with the instruction immediately af- 
ter the Interrupted instruction. Sections 2.7.3 and 
2.7.4 discuss the differences between Maskable and 
Non-Maskable interrupts. 

Exceptions are classified as faults, traps, or aborts 
depending on the way they are reported, and wheth- 
er or not restart of the instruction causing the excep- 
tion is supported. Faults are exceptions that are de- 
tected and serviced before the execution of the 
faulting instruction. A fault would occur in a virtual 
memory system, when the processor referenced a 
page or a segment which was not present. The oper- 
ating system would fetch the page or segment from 
disk, and then the Intel486 Microprocessor would re- 
start the instruction. Traps are exceptions that are 
reported immediately after the execution of the in- 
struction which caused the problem. User defined 
interrupts are examples of traps. Aborts are excep- 
tions which do not permit the precise location of the 
instruction causing the exception to be determined. 
Aborts are used to report severe errors, such as a 
hardware error, or illegal values in system tables. 

Thus, when an interrupt service routine has been 
completed, execution proceeds from the instruction 
immediately following the interrupted instruction. On 
the other hand, the return address from an excep- 
tion fault routine will always point at the instruction 
causing the exception and include any leading in- 
struction prefixes. Table 2.16 summarizes the possi- 
ble interrupts for the Intel486 Microprocessor and 
shows where the return address points. 

The Intel486 Microprocessor has the ability to han- 
dle up to 256 different interrupts/exceptions. In or- 
der to service the interrupts, a table with up to 256 
interrupt vectors must be defined. The interrupt vec- 
tors are simply pointers to the appropriate interrupt 
service routine. In Real Mode (see Section 3.1), the 
vectors are 4 byte quantities, a Code Segment plus 
a 1 6-bit offset; in Protected Mode, the interrupt vec- 
tors are 8 byte quantities, which are put in an Inter- 
rupt Descriptor Table (see Section 4.3.3.4). Of the 
256 possible interrupts, 32 are reserved for use by 
Intel, the remaining 224 are free to be used by the 
system designer. 

2.7.2 INTERRUPT PROCESSING 

When an interrupt occurs the following actions hap- 
pen. First, the current program address and the 
Flags are saved on the stack to allow resumption of 
the interrupted program. Next, an 8-bit vector is sup- 
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plied to the Intel486 Microprocessor which identifies 
the appropriate entry in the interrupt table. The table 
contains the starting address of the interrupt service 
routine. Then, the user supplied interrupt service 
routine is executed. Finally, when an IRET instruc- 
tion is executed the old processor state is restored 
and program execution resumes at the appropriate 
instruction. 

The 8-bit interrupt vector is supplied to the Intel486 
Microprocessor in several different ways: exceptions 
supply the interrupt vector internally; software INT 
instructions contain or imply the vector; maskable 
hardware interrupts supply the 8-bit vector via the 
interrupt acknowledge bus sequence. Non-Maska- 
ble hardware interrupts are assigned to interrupt 
vector 2. 



2.7.3 MASKABLE INTERRUPT 

Maskable interrupts are the most common way used 
by the Intel486 Microprocessor to respond to asyn- 
chronous external hardware events. A hardware In- 
terrupt occurs when the INTR is pulled high and 
the Interrupt Flag bit (IF) is enabled. The processor 
only responds to interrupts between instructions, 
(REPeat String instructions, have an "interrupt win- 
dow", between memory moves, which allows inter- 
rupts during long string moves). When an interrupt 
occurs the processor reads an 8-bit vector supplied 
by the hardware which identifies the source of the 
interrupt, (one of 224 user defined interrupts). The 
exact nature of the interrupt sequence is discussed 
in Section 7.2.10. 





Table 2.16. Interrupt Vector Assignments 






Function 


Interrupt 
Number 


Instruction Which 
Can Cause 
Exception 


Return Address 

Points to 

Faulting 

Instruction 


Type 


Divide Error 





DIV, IDIV 


YES 


FAULT 


Debug Exception 


1 


Any Instruction 


YES 


TRAP* 


NMI Interrupt 


2 


INT 2 or NMI 


NO 


NMI 


One Byte Interrupt 


3 


INT 


NO 


TRAP 


Interrupt on Overflow 


4 


INTO 


NO 


TRAP 


Array Bounds Check 


5 


BOUND 


YES 


FAULT 


Invalid OP-Code 


6 


Any Illegal Instruction 


YES 


FAULT 


Device Not Available 


7 


ESC. WAIT 


YES 


FAULT 


Double Fault 


8 


Any Instruction That Can 
Generate an Exception 




ABORT 


Intel Reserved 


9 








Invalid TSS 


10 


JMP, CALL, IRET, INT 


YES 


FAULT 


Segment Not Present 


11 


Segment Register Instructions 


YES 


FAULT 


Stack Fault 


12 


Stack References 


YES 


FAULT 


General Protection Fault 


13 


Any Memory Reference 


YES 


FAULT 


Page Fault 


14 


Any Memory Access or Code Fetch 


YES 


FAULT 


Intel Reserved 


15 








Floating Point Error 


16 


Floating Point, WAIT 


YES 


FAULT 


Alignment Check Interrupt 


17 


Unaligned Memory Access 


YES 


FAULT 


Intel Reserved 


18-31 








Two Byte Interrupt 


0-255 


INTn 


NO 


TRAP 



*Some debug exceptions may report both traps on the previous instruction, and faults on the next instruction. 
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The IF bit in the EFLAG registers is reset when an 
interrupt is being serviced. This effectively disables 
servicing additional interrupts during an interrupt 
service routine. However, the IF may be set explicitly 
by the interrupt handler, to allow the nesting of inter- 
rupts. When an I RET Instruction is executed the 
original state of the IF is restored. 

2.7.4 NON-MASKABLE INTERRUPT 

Non-maskable interrupts provide a method of servic- 
ing very high priority interrupts. A common example 
of the use of a non-maskable interrupt (NMI) would 
be to activate a power failure routine. When the NMI 
input is pulled high it causes an interrupt with an 
internally supplied vector value of 2. Unlike a normal 
hardware interrupt, no interrupt acknowledgment se- 
quence is performed for an NMI. 

While executing the NMI servicing procedure, the In- 
tel486 Microprocessor will not service further NMI 
requests until an interrupt return (IRET) instruction is 
executed or the processor is reset. If NMI occurs 
while currently servicing an NMI, its presence will be 
saved for servicing after executing the first IRET in- 
struction. The IF bit is cleared at the beginning of an 
NMI interrupt to inhibit further INTR interrupts. 

2.7.5 SOFTWARE INTERRUPTS 

A third type of interrupt/exception for the Intel486 
Microprocessor is the software interrupt. An INT n 
instruction causes the processor to execute the in- 
terrupt service routine pointed to by the nth vector in 
the interrupt table. 

A special case of the two byte software interrupt INT 
n is the one byte INT 3, or breakpoint interrupt. By 
inserting this one byte instruction in a program, the 
user can set breakpoints in his program as a debug- 
ging tool. 

A final type of software interrupt is the single step 
interrupt. It is discussed in Section 9.2. 



2.7.6 INTERRUPT AND EXCEPTION 
PRIORITIES 

Interrupts are externally-generated events. Maska- 
ble Interrupts (on the INTR input) and Non-Maskable 
Interrupts (on the NMI input) are recognized at in- 
struction boundaries. When NMI and maskable 
INTR are both recognized at the same instruction 
boundary, the Intel486 Microprocessor invokes the 
NMI service routine first. If, after the NMI service 
routine has been invoked, maskable interrupts are 
still enabled, then the Intel486 Microprocessor will 
invoke the appropriate interrupt service routine. 

Table 2.17a. lntel486TM Microprocessor Priority 

for Invoking Service Routines in Case 

of Simultaneous External Interrupts 



1.NMI 
2. INTR 



Exceptions are internally-generated events. Excep- 
tions are detected by the Intel486 Microprocessor if, 
in the course of executing an instruction, the In- 
tel486 Microprocessor detects a problematic condi- 
tion. The Intel486 Microprocessor then immediately 
invokes the appropriate exception service routine. 
The state of the Intel486 Microprocessor is such 
that the instruction causing the exception can be re- 
started. If the exception service routine has taken 
care of the problematic condition, the instruction will 
execute without causing the same exception. 

It is possible for a single instruction to generate sev- 
eral exceptions (for example, transferring a single 
operand could generate two page faults if the oper- . 
and location spans two "not present" pages). How- 
ever, only one exception is generated upon each at- 
tempt to execute the instruction. Each exception 
service routine should correct its corresponding ex- 
ception, and restart the instruction. In this manner, 
exceptions are serviced until the instruction exe- 
cutes successfully. 

As the Intel486 Microprocessor executes instruc- 
tions, it follows a consistent cycle in checking for 
exceptions, as shown in Table 2.17b. This cycle is 
repeated as each instruction is executed, and oc- 
curs in parallel with instruction decoding and execu- 
tion. 
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Table 2.17b. Sequence of Exception Checking 



Consider the case of the Intel486 Microproces- 
sor having just completed an Instruction. It then 
performs the following checks before reaching 
the point where the next instruction is completed: 

1 . Check for Exception 1 Traps from the Instruc- 
tion just completed (single-step via Trap Flag, 
or Data Breakpoints set In the Debug Regis- 
ters). 

2. Check for Exception 1 Faults in the next in- 
struction (Instruction Execution Breakpoint 
set in the Debug Registers for the next in- 
struction). 

3. Check for external NMI and INTR. 

4. Check for Segmentation Faults that prevent- 
ed fetching the entire next instruction (excep- 
tions 11 or 13). 

5. Check for Page Faults that prevented fetching 
the entire next instruction (exception 14). 

6. Check for Faults decoding the next Instruction 
(exception 6 If Illegal opcode; exception 6 If in 
Real Mode or in Virtual 8086 Mode and at- 
tempting to execute an Instruction for Protect- 
ed Mode only (see Section 4.6.4); or excep- 
tion 1 3 if instruction is longer than 1 5 bytes, or 
privilege violation in Protected Mode (i.e., not 
atlOPLoratCPL=0). 

7. If WAIT opcode, check if TS = 1 and MP = 1 
(exception 7 if both are 1). 

8. If opcode for Floating Point Unit, check if 
EM = 1 or TS= 1 (exception 7 if either are 1). 

9. If opcode for Floating Point Unit (FPU), check 
FPU error status (exception 1 6 if error status 
is asserted). 

10. Check In the following order for each memo- 
ry reference required by the Instruction: 

a. Check for Segmentation Faults that pre- 
vent transferring the entire memory quan- 
tity (exceptions 11, 12, 13). 

b. Check for Page Faults that prevent trans- 
ferring the entire memory quantity (ex- 
ception 14). 

NOTE: 

The order stated supports the concept of the 
paging mechanism being "underneath" the seg- 
mentation mechanism. Therefore, for any given 
code or data reference In memory, segmenta- 
tion exceptions are generated before paging ex- 
ceptions are generated. 



2.7.7 INSTRUCTION RESTART 

The Intel486 Microprocessor fully supports restart- 
ing all instructions after faults. If an exception is de- 
tected in the Instruction to be executed (exception 
categories 4 through 10 in Table 2.17b), the Intel486 
Microprocessor Invokes the appropriate exception 
service routine. The Intel486 Microprocessor is in a 
state that permits restart of the instruction, for all 
cases but those in Table 2.17c. Note that all such 
cases are easily avoided by proper design of the 
operating system. 

Table 2.17c. Conditions Preventing 
Instruction Restart 



An instruction causes a task switch to a task 
whose Task State Segment Is partially "not 
present". (An entirely "not present" TSS is re- 
startable.) Partially present TSS's can be avoid- 
ed either by keeping the TSS's of such tasks 
present In memory, or by aligning TSS segments 
to reside entirely within a single 4K page (for TSS 
segments of 4 Kbytes or less). 

NOTE: 

These conditions are avoided by using the oper- 
ating system designs mentioned in this table. 



2.7.8 DOUBLE FAULT 

A Double Fault (exception 8) results when the proc- 
essor attempts to invoke an exception service rou- 
tine for the segment exceptions (10, 11, 12 or 13), 
but in the process of doing so, detects an exception 
other than a Page Fault (exception 14). 

A Double Fault (exception 8) will also be generated 
when the processor attempts to invoke the Page 
Fault (exception 14) service routine, and detects an 
exception other than a second Page Fault. In any 
functional system, the entire Page Fault service rou- 
tine must remain "present" In memory. 

When a Double Fault occurs, the Intel486 Micro- 
processor invokes the exception service routine for 
exception 8. 



2.7.9 FLOATING POINT INTERRUPT VECTORS 

Several interrupt vectors of the Intel486 Microproc- 
essor are used to report exceptional conditions 
while executing numeric programs In either real or 
protected mode. Table 2.18 shows these Interrupts 
and their causes. 
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Table 2.18. Interrupt Vectors Used by FPU 



Interrupt 
Number 


Cause of Interrupt 


7 


A Floating Point instruction was encountered when EM or TS of the lntel486TM Processor 
control register zero (CRO) was set. EM = 1 indicates that software emulation of the 
instruction is required. When TS Is set, either a Floating Point or WAIT Instruction causes 
interrupt 7. This indicates that the current FPU context may not belong to the current task. 


13 


The first word or doubleword of a numeric operand Is not entirely within the limit of its 
segment. The return address pushed onto the stack of the exception handler points at the 
Floating Point instruction that caused the exception, including any prefixes. The FPU has 
not executed this instruction; the instruction pointer and data pointer register refer to a 
previous, correctly executed instruction. 


16 


The previous numerics instruction caused an unmasked exception. The address of the 
faulty Instruction and the address of its operand are stored In the Instruction pointer and 
data pointer registers. Only Floating Point and WAIT Instructions can cause this interrupt. 
The lntel486TM Processor return address pushed onto the stack of the exception handler 
points to a WAIT or Floating Point Instruction (Including prefixes). This instruction can be 
restarted after clearing the exception condition In the FPU. The FNINIT, FNCLEX, 
FNSTSW, FNSTENV, and FNSAVE Instructions cannot cause this interrupt. 
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3.0 REAL MODE ARCHITECTURE 



3.1 Real Mode Introduction 

When the processor is reset or powered up it is ini- 
tialized in Real Mode. Real Mode has the same base 
architecture as the 8086, but allows access to the 
32-bit register set of the Intel486 Microprocessor. 
The addressing mechanism, memory size, interrupt 
handling, are all identical to the Real Mode on the 
80286. 

All of the Intel486 Microprocessor instructions are 
available in Real Mode (except those instructions 
listed in Section 4.6.4). The default operand size in 
Real Mode is 16 bits, just like the 8086. In order to 
use the 32-bit registers and addressing modes, over- 
ride prefixes must be used. In addition, the segment 
size on the Intel486 Microprocessor in Real Mode is 
64 Kbytes so 32-bit effective addresses must have a 
value less the OOOOFFFFH. The primary purpose of 
Real Mode Is to set up the processor for Protected 
Mode Operation. 

The LOCK prefix on the Intel486 Microprocessor, 
even in Real Mode, is more restrictive than on the 
80286. This is due to the addition of paging on the 
Intel486 Microprocessor in Protected Mode and Vir- 
tual 8086 Mode. Paging makes it impossible to guar- 
antee that repeated string instructions can be 
LOCKed. The Intel486 Microprocessor can't require 
that all pages holding the string be physically pres- 
ent In memory. Hence, a Page Fault (exception 14) 
might have to be taken during the repeated string 
instruction. Therefore the LOCK prefix can't be sup- 
ported during repeated string instructions. 



These are the only instruction forms where the 
LOCK prefix is legal on the Intel486 Microprocessor: 



Opcode 


Operands 
(Dest, Source) 


BIT Test and 


Mem, Reg/immed 


SET/RESET/COMPLEMENT 




XCHG 


Reg, Mem 


XCHG 


Mem, Reg 


ADD, OR, ADC, SBB, 


Mem, Reg/immed 


AND, SUB. XOR 




NOT, NEG, INC, DEC 


Mem 


CMPXCHG. XADD 


Mem, Reg 



An exception 6 will be generated if a LOCK prefix is 
placed before any instruction form or opcode not 
listed above. The LOCK prefix allows indivisible 
read/ modify/write operations on memory operands 
using the instructions above. For example, even the 
ADD Reg, Mem is not LOCKable, because the Mem 
operand is not the destination (and therefore no 
memory read/modify/operation is being performed). 

Since, on the Intel486 Microprocessor, repeated 
string instructions are not LOCKable, it is not possi- 
ble to LOCK the bus for a long period of time. There- 
fore, the LOCK prefix is not lOPL-sensitive on the 
Intel486 Microprocessor. The LOCK prefix can be 
used at any privilege level, but only on the instruc- 
tion forms listed above. 



3.2 Memory Addressing 

In Real Mode the maximum memory size is limited to 
1 megabyte. Thus, only address lines A2-A19 are 
active. (Exception, after RESET address lines A20- 
A31 are high during CS-relative memory cycles until 
an intersegment jump or call is executed (see Sec- 
tion 6.5)). 







15 










240440-9 




OFFSET 








19 













SEGMENT 
SELECTOR 


0000 




/ 


FIXED AT 64K IN 
REAL MODE 














6^ 


^ \ SELECTED 
J SEGMENT 




->© — ► 


MEMORY OPERAND 


i 














" " ► 


SEGMENT BASE 



















Figure 3.1. Real Address Mode Addressing 
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Since paging is not allowed in Real Mode the linear 
addresses are the same as physical addresses. 
Physical addresses are formed in Real Mode by 
adding the contents of the appropriate segment reg- 
ister which is shifted left by four bits to an effective 
address. This addition results in a physical address 
from OOOOOOOOH to 0010FFEFH. This is compatible 
with 80286 Real Mode. Since segment registers are 
shifted left by 4 bits, Real Mode segments always 
start on 1 6 byte boundaries. 

All segments in Real Mode are exactly 64 Kbytes 
long, and may be read, written, or executed. The 
Intel486 Microprocessor will generate an exception 
1 3 if a data operand or instruction fetch occurs past 
the end of a segment (i.e., if an operand has an 
offset greater than FFFFH, for example a word with 
a low byte at FFFFH and the high byte at OOOOH). 

Segments may be overlapped in Real Mode. Thus, if 
a particular segment does not use all 64 Kbytes an- 
other segment can be overlayed on top of the un- 
used portion of the previous segment. This allows 
the programmer to minimize the amount of physical 
memory needed for a program. 

3.3 Reserved Locations 

There are two fixed areas in memory which are re- 
served in Real address mode: system initialization 
area and the Interrupt table area. Locations OOOOOH 
through 003FFH are reserved for interrupt vectors. 
Each one of the 256 possible interrupts has a 4-byte 
jump vector reserved for it. Locations FFFFFFFOH 
through FFFFFFFFH are reserved for system initiali- 
zation. 



3.4 Interrupts 

Many of the exceptions shown in Table 2.16 and 
discussed in Section 2.7 are not applicable to Real 
Mode operation, in particular exceptions 10, 11, 14, 
1 7, will not happen in Real Mode. Other exceptions 
have slightly different meanings in Real Mode; Table 
3.1 identifies these exceptions. 



3.5 Shutdown and Halt 

The HLT instruction stops program execution and 
prevents the processor from using the local bus until 
restarted. Either NMI, INTR with interrupts enabled 
(IF= 1), or RESET will force the Intel486 Microproc- 
essor out of halt. If interrupted, the saved CS:IP will 
point to the next instruction after the HLT. 

As in the case in protected mode, the shutdown will 
occur when a severe error is detected that prevents 
further processing. In Real Mode, shutdown can oc- 
cur under two conditions: 

An interrupt or an exception occur (exceptions 8 or 
13) and the interrupt vector is larger than the Inter- 
rupt Descriptor Table (i.e., there is not an interrupt 
handler for the interrupt). 

A CALL, INT or PUSH instruction attempts to wrap 
around the stack segment when SP is not even (i.e., 
pushing a value on the stack when SP = 0001 re- 
sulting in a stack segment greater than FFFFH). 

An NMI input can bring the processor out of shut- 
down if the Interrupt Descriptor Table limit is large 
enough to contain the NMI interrupt vector (at least 
001 7H) and the stack has enough room to contain 
the vector and flag information (i.e., SP Is greater 
than 0005H). If these conditions are not met, the 
Intel486 CPU is unable to execute the NMI and exe- 
cutes another shutdown cycle. In this case, the proc- 
essor remains in the shutdown and can only exit via 
the RESET input. 

Table 3.1. Exceptions with Different l\/leanings In Real Mode (see Table 2.16) 



Function 


Interrupt 
Number 


Related 
Instructions 


Return 
Address Location 


Interrupt table limit too small 


8 


INT Vector is not 
within table limit 


Before 
Instruction 


CS, DS, ES, FS, GS 
Segment overrun exception 


13 


Word memory reference 
beyond offset = FFFFH. 
An attempt to execute 
past the end of CS segment. 


Before 
Instruction 


SS Segment overrun exception 


12 


Stack Reference 
beyond offset = FFFFH 


Before 
Instruction 
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4.0 PROTECTED MODE 
ARCHITECTURE 



4.1 Introduction 

The complete capabilities of the Intel486 Microproc- 
essor are unlocked when the processor operates in 
Protected Virtual Address Mode (Protected Mode). 
Protected Mode vastly increases the linear address 
space to four gigabytes (232 bytes) and allows the 
running of virtual memory programs of almost unlim- 
ited size (64 terabytes or 246 bytes). In addition Pro- 
tected Mode allows the Intel486 Microprocessor to 
run all of the existing 8086, 80286 and 386 micro- 
processor software, while providing a sophisticated 
memory management and a hardware-assisted pro- 
tection mechanism. Protected Mode allows the use 
of additional instructions especially optimized for 
supporting multitasking operating systems. The base 
architecture of the Intel486 Microprocessor remains 
the same, the registers, instructions, and addressing 
modes described In the previous sections are re- 
tained. The main difference between Protected 
Mode, and Real Mode from a programmer's view is 
the increased address space, and a different ad- 
dressing mechanism. 



4.2 Addressing Mechanism 

Like Real Mode, Protected Mode uses two compo- 
nents to form the logical address, a 1 6-bit selector is 
used to determine the linear base address of a seg- 
ment, the base address is added to a 32-bit effective 
address to form a 32-bit linear address. The linear 
address is then either used as the 32-bit physical 
address, or if paging is enabled the paging mecha- 
nism maps the 32-bit linear address into a 32-bit 
physical address. 

The difference between the two modes lies in calcu- 
lating the base address. In Protected Mode the se- 
lector is used to specify an index into an operating 
system defined table (see Figure 4.1). The table 
contains the 32-bit base address of a given seg- 
ment. The physical address is formed by adding the 
base address obtained from the table to the offset. 

Paging provides an additional memory management 
mechanism which operates only in Protected Mode. 
Paging provides a means of managing the very large 
segments of the Intel486 Microprocessor. As such, 
paging operates beneath segmentation. The paging 
mechanism translates the protected linear address 
which comes from the segmentation unit into a 
physical address. Figure 4.2 shows the complete In- 
tel486 Microprocessor addressing mechanism with 
paging enabled. 
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Figure 4.1. Protected Mode Addressing 
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Figure 4.2. Paging and Segmentation 



4.3 Segmentation 



4.3.1 SEGMENTATION INTRODUCTION 

Segmentation is one method of memory manage- 
ment. Segmentation provides the basis for protec- 
tion. Segments are used to encapsulate regions of 
memory which have common attributes. For exam- 
ple, all of the code of a given program could be con- 
tained in a segment, or an operating system table 
may reside in a segment. All information about a 
segment is stored in an 8 byte data structure called 
a descriptor. All of the descriptors in a system are 
contained in tables recognized by hardware. 

4.3.2 TERIVIINOLOGY 

The following terms are used throughout the discus- 
sion of descriptors, privilege levels and protection: 

PL: Privilege Level— One of the four hierarchical 
privilege levels. Level is the most privileged level 
and level 3 is the least privileged. More privileged 
levels are numerically smaller than less privileged 
levels. 

RPL: Requestor Privilege Level— The privilege level 
of the original supplier of the selector. RPL is deter- 
mined by the least two significant bits of a selector. 



DPL: Descriptor Privilege Level— This Is the least 
privileged level at which a task may access that de- 
scriptor (and the segment associated with that de- 
scriptor). Descriptor Privilege Level is determined by 
bits 6:5 in the Access Right Byte of a descriptor. 

GPL: Current Privilege Level— The privilege level at 
which a task Is currently executing, which equals the 
privilege level of the code segment being executed. 
CPL can also be determined by examining the low- 
est 2 bits of the CS register, except for conforming 
code segments. 

EPL: Effective Privilege Level — ^The effective privi- 
lege level is the least privileged of the RPL and DPL. 
Since smaller privilege level values indicate greater 
privilege, EPL is the numerical maximum of RPL and 
DPL. 

Task: One instance of the execution of a program. 
Tasks are also referred to as processes. 

4.3.3 DESCRIPTOR TABLES 

4.3.3.1 Descriptor Tables Introduction 

The descriptor tables define all of the segments 
which are used in an Intel486 Microprocessor sys- 
tem. There are three types of tables on the Intel486 
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Microprocessor which hold descriptors: the Global 
Descriptor Table, Local Descriptor Table, and the In- 
terrupt Descriptor Table. All of the tables are vari- 
able length memory arrays. They can range in size 
between 8 bytes and 64 Kbytes. Each table can hold 
up to 8192 8-byte descriptors. The upper 13 bits of a 
selector are used as an index into the descriptor ta- 
ble. The tables have registers associated with them 
which hold the 32-bit linear base address, and the 
16-bit limit of each table. 

Each of the tables has a register associated with it, 
the GDTR, LDTR, and the IDTR (see Figure 4.3). 
The LGDT, LLDT, and LIDT instructions, load the 
base and limit of the Global, Local, and Interrupt De- 
scriptor Tables, respectively, into the appropriate 
register. The SGDT, SLDT, and SIDT store the base 
and limit values. These tables are manipulated by 
the operating system. Therefore, the load descriptor 
table instructions are privileged instructions. 
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Figure 4.3. Descriptor Table Registers 



4.3.3.2 Global Descriptor Table 

The Global Descriptor Table (GDT) contains de- 
scriptors which are possibly available to all of the 
tasks in a system. The GDT can contain any type of 
segment descriptor except for descriptors which are 
used for servicing interrupts (i.e., interrupt and trap 
descriptors). Every Intel486 Microprocessor system 
contains a GDT. Generally the GDT contains code 
and data segments used by the operating systems 
and task state segments, and descriptors for the 
LDTs in a system. 

The first slot of the Global Descriptor Table corre- 
sponds to the null selector and is not used. The null 
selector defines a null pointer value. 



4.3.3.3 Local Descriptor Table 

LDTs contain descriptors which are associated with 
a given task. Generally, operating systems are de- 
signed so that each task has a separate LDT. The 
LDT may contain only code, data, stack, task gate, 
and call gate descriptors. LDTs provide a mecha- 
nism for isolating a given task's code and data seg- 
ments from the rest of the operating system, while 
the GDT contains descriptors for segments which 
are common to all tasks. A segment cannot be ac- 
cessed by a task if its segment descriptor does not 
exist in either the current LDT or the GDT. This pro- 
vides both isolation and protection for a task's seg- 
ments, while still allowing global data to be shared 
among tasks. 

Unlike the 6 byte GDT or IDT registers which contain 
a base address and limit, the visible portion of the 
LDT register contains only a 16-bit selector. This se- 
lector refers to a Local Descriptor Table descriptor in 
the GDT. 



4.3.3.4 Interrupt Descriptor Table 

The third table needed for Intel486 Microprocessor 
systems is the Interrupt Descriptor Table. (See Fig- 
ure 4.4.) The IDT contains the descriptors which 
point to the location of up to 256 interrupt service 
routines. The IDT may contain only task gates, inter- 
rupt gates, and trap gates. The IDT should be at 
least 256 bytes in size in order to hold the descrip- 
tors for the 32 Intel Reserved Interrupts. Every inter- 
rupt used by a system must have an entry in the IDT. 
The IDT entries are referenced via INT instructions, 
external interrupt vectors, and exceptions. (See Sec- 
tion 2.7 Interrupts). 
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4.3.4 DESCRIPTORS 

4.3.4.1 Descriptor Attribute Bits 

The object to which the segment selector points to 
is called a descriptor. Descriptors are eight byte 
quantities which contain attributes about a given re- 
gion of linear address space (i.e., a segment). These 
attributes include the 32-bit base linear address of 
the segment, the 20-blt length and granularity of the 
segment, the protection level, read, write or execute 
privileges, the default size of the operands (1 6-bit or 
32-bit), and the type of segment. All of the attribute 
information about a segment is contained in 1 2 bits 
In the segment descriptor. Figure 4.5 shows the gen- 
eral format of a descriptor. All segments on the In- 
tel486 Microprocessor have three attribute fields in 
common: the P bit, the DPL bit, and the S bit. The 
Present P bit is 1 if the segment is loaded in physical 
memory, if P = then any attempt to access this 



segment causes a not present exception (exception 
11). The Descriptor Privilege Level DPL is a two-bit 
field which specifies the protection level 0-3 associ- 
ated with a segment. 

The Intel486 Microprocessor has two main catego- 
ries of segments: system segments and non-system 
segments (for code and data). The segment S bit in 
the segment descriptor determines if a given seg- 
ment is a system segment or a code or data seg- 
ment. If the 8 bit is 1 then the segment is either a 
code or data segment, if it is then the segment is a 
system segment. 

4.3.4.2 lntel486TM CPU Code, Data Descriptors 
(S=1) 

Figure 4.6 shows the general format of a code and 
data descriptor and Table 4.1 illustrates how the bits 
in the Access Rights Byte are interpreted. 
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In a maximum-size segment (i.e., a segment with G = 1 and segment limit 19...0 = FFFFFH), the lowest 12 bits of the 
segment base should be zero (i.e., segment base 11...000=000H). 



Base Address of the segment 

The length of the segment 

Present Bit 1 = Present = Not Present 

Descriptor Privilege Level 0-3 

Segment Descriptor 0= System Descriptor 1 =Code or Data Segment Descriptor 

Type of Segment 

Accessed Bit 

Granularity Bit 1 = Segment length is page granular = Segment length is byte granular 

Default Operation Size (recognized in code segment descriptors only) 

1 = 32-bit segment = 1 6-bit segment 

Bit must be zero (0) for compatibility with future processors 

Available field for user or OS 



Figure 4.5. Segment Descriptors 
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D/B 1 = Default Instruction Attributes are 32-Bits 
= Default Instruction Attributes are 16-Bits 
AVL Available field for user or OS 
G Granularity Bit 1 = Segment length is page granular 

= Segment length is byte granular 
Bit must be zero (0) for compatibility with future processors 



Figure 4.6. Segment Descriptors 
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Table 4.1. Access Rights Byte Definition for Code and Data Descriptions 



Type 
Field 
Definition 



Bit 
Position 


Name 


Function 


7 

6-5 
4 


Present (P) 

Descriptor Privilege 
Level (DPL) 
Segment Descrip- 
tor (S) 


P = 1 Segment is mapped Into physical memory. 

P = No mapping to physical memory exits, base and limit are 

not used. 

Segment privilege attribute used in privilege tests. 

S = 1 Code or Data (includes stacks) segment descriptor. 
S = System Segment Descriptor or Gate Descriptor. 


3 
2 

1 


Executable (E) 
Expansion Direc- 
tion (ED) 
Writeable (W) 


E = Descriptor type is data segment: 

ED = Expand up segment, offsets must be ^ limit. 

ED = 1 Expand down segment, offsets must be > limit. 

W = Data segment may not be written into. 

W = 1 Data segment may be written into. 


If 

Data 
' Segment 

(S=1, 
E = 0) 


3 
2 

1 


Executable (E) 
Conforming (C) 

Readable (R) 


E = 1 Descriptor type is code segment: ^ 
C = 1 Code segment may only be executed 

when CPL ^ DPL and CPL 

remains unchanged. 
R = Code segment may not be read. 
R = 1 Code segment may be read. j 


If 

Code 
Segment 
^(S = 1. 
E=1) 





Accessed (A) 


A = Segment has not been accessed. 
A = 1 Segment selector has been loaded into segment register 
or used by selector test instructions. 



Code and data segments have several descriptor 
fields In common. The accessed A bit is set whenev- 
er the processor accesses a descriptor. The A bit is 
used by operating systems to keep usage statistics 
on a given segment. The G bit, or granularity bit, 
specifies if a segment length is byte-granular or 
page-granular. Intel486 Microprocessor segments 
can be one megabyte long with byte granularity 
(G = 0) or four gigabytes with page granularity 
(G = 1), (i.e., 220 pages each page is 4 Kbytes in 
length). The granularity is totally unrelated to paging. 
A Intel486 Microprocessor system can consist of 
segments with byte granularity, and page granularity, 
whether or not paging is enabled. 

The executable E bit tells if a segment is a code or 
data segment. A code segment (E = 1 , S = 1 ) may be 
execute-only or execute/read as determined by the 
Read R bit. Code segments are execute only if 
R = 0, and execute/read if R = 1. Code segments 
may never be written Into. 

NOTE: 

Code segments may be modified via aliases. Alias- 
es are writeable data segments which occupy the 
same range of linear address space as the code 
segment. 



The D bit indicates the default length for operands 
and effective addresses. If D = 1 then 32-bit oper- 
ands and 32-bit addressing modes are assumed. If 
D = then 16-bit operands and 16-bit addressing 
modes are assumed. Therefore all existing 80286 
code segments will execute on the Intel486 Micro- 
processor assuming the D bit is set 0. 

Another attribute of code segments is determined by 
the conforming C bit. Conforming segments, C=1, 
can be executed and shared by programs at differ- 
ent privilege levels. (See Section 4.4 Protection.) 

Segments identified as data segments (E = 0, S = 1) 
are used for two types of Intel486 Microprocessor 
segments: stack and data segments. The expansion 
direction (ED) bit specifies if a segment expands 
downward (stack) or upward (data). If a segment is a 
stack segment all offsets must be greater than the 
segment limit. On a data segment all offsets must be 
less than or equal to the limit. In other words, stack 
segments start at the base linear address plus the 
maximum segment limit and grow down to the base 
linear address plus the limit. On the other hand, data 
segments start at the base linear address and ex- 
pand to the base linear address plus limit. 
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The write W bit controls the ability to write into a 
segment. Data segments are read-only If W = 0. The 
stack segment must have W = 1 . 

The B bit controls the size of the stack pointer regis- 
ter. If B = 1, then PUSHes, POPs, and CALLs all use 
the 32-bit ESP register for stack references and as- 
sume an upper limit of FFFFFFFFH. If 8 = 0, stack 
instructions all use the 16-bit SP register and as- 
sume an upper limit of FFFFH. 

4.3.4.3 System Descriptor Formats 

System segments describe information about oper- 
ating system tables, tasks, and gates. Figure 4.7 
shows the general format of system segment de- 
scriptors, and the various types of system segments. 
Intel486 Microprocessor system descriptors contain 
a 32-bit base linear address and a 20-bit segment 
limit. 80286 system descriptors have a 24-bit base 
address and a 16-bit segment limit. 80286 system 
descriptors are identified by the upper 16 bits being 
all zero. 

4.3.4.4 LDT Descriptors (8 = 0, TYPE = 2) 

LDT descriptors (S = 0, TYPE = 2) contain informa- 
tion about Local Descriptor Tables. LDTs contain a 
table of segment descriptors, unique to a particular 
task. Since the instruction to load the LDTR is only 
available at privilege level 0, the DPL field is ignored. 
LDT descriptors are only allowed in the Global De- 
scriptor Table (GDT). 



4.3.4.5 TSS Descriptors (8=0, 
TYPE=1,3,9, B) 

A Task State Segment (TSS) descriptor contains in- 
formation about the location, size, and privilege level 
of a Task State Segment (TSS). A TSS in turn is a 
special fixed format segment which contains all the 
state information for a task and a linkage field to 
permit nesting tasks. The TYPE field is used to indi- 
cate whether the task is currently BUSY (i.e., on a 
chain of active tasks) or the TSS is available. The 
TYPE field also indicates if the segment contains a 
80286 or an Intel486 Microprocessor TSS. The Task 
Register (TR) contains the selector which points to 
the current Task State Segment. 

4.3.4.6 Gate Descriptors (8=0, 
TYPE = 4-7,C, F) 

Gates are used to control access to entry points 
within the target code segment. The various types of 
gate descriptors are call gates, task gates, inter- 
rupt gates, and trap gates. Gates provide a level of 
indirection between the source and destination of 
the control transfer. This indirection allows the proc- 
essor to automatically perform protection checks. It 
also allows system designers to control entry points 
to the operating system. Call gates are used to 
change privilege levels (see Section 4.4 Protec- 
tion), task gates are used to perform a task switch, 
and interrupt and trap gates are used to specify in- 
terrupt service routines. 
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Type Defines 

8 Invalid 

9 Available lntel486TM CPU TSS 
A Undefined (Intel Reserved) 

B Busy lntel486TM CPU TSS 

C lntel486TM CPU Call Gate 

D Undefined (Intel Reserved) 

E lntel486TM CPU Interrupt Gate 

F lntel486TM CPU Trap Gate 



Figure 4.7. System Segment Descriptors 
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Figure 4.8 shows the format of the four types of gate 
descriptors. Call gates are primarily used to transfer 
program control to a more privileged level. The call 
gate descriptor consists of three fields: the access 
byte, a long pointer (selector and offset) which 
points to the start of a routine and a word count 
which specifies how many parameters are to be cop- 
ied from the caller's stack to the stack of the called 
routine. The word count field is only used by call 
gates when there is a change in the privilege level, 
other types of gates ignore the word count field. 

Interrupt and trap gates use the destination selector 
and destination offset fields of the gate descriptor as 
a pointer to the start of the interrupt or trap handler 
routines. The difference between interrupt gates and 
trap gates is that the interrupt gate disables inter- 
rupts (resets the IF bit) while the trap gate does not. 

Task gates are used to switch tasks. Task gates 
may only refer to a task state segment (see Section 
4.4.6 Task Switching) therefore only the destination 
selector portion of a task gate descriptor is used, 
and the destination offset is ignored. 

Exception 1 3 Is generated when a destination selec- 
tor does not refer to a correct descriptor type, i.e., a 
code segment for an interrupt, trap or call gate, a 
TSS for a task gate. 



The access byte format is the same for all gate de- 
scriptors. P = 1 indicates that the gate contents are 
valid. P = indicates the contents are not valid and 
causes exception 11 if referenced. DPL is the de- 
scriptor privilege level and specifies when this de- 
scriptor may be used by a task (see Section 4.4 Pro- 
tection). The S field, bit 4 of the access rights byte, 
must be to indicate a system control descriptor. 
The type field specifies the descriptor type as indi- 
cated in Figure 4.8. 

4.3.4.7 Differences Between lntel486TM 

l\/licroprocessor and 80286 Descriptors 

In order to provide operating system compatibility 
between the 80286 and Intel486 Microprocessor, 
the Intel486 Microprocessor supports all of the 
80286 segment descriptors. Figure 4.9 shows the 
general format of an 80286 system segment de- 
scriptor. The only differences between 80286 and 
Intel486 Microprocessor descriptor formats are that 
the values of the type fields, and the limit and base 
address fields have been expanded for the Intel486 
Microprocessor. The 80286 system segment de- 
scriptors contained a 24-bit base address and 1 6-bit 
limit, while the Intel486 Microprocessor system seg- 
ment descriptors have a 32-bit base address, a 20- 
bit limit field, and a granularity bit. 
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Gate Descriptor Fields 
Name Value Description 

Type 4 80286 call gate 

5 Task gate (for 80286 or lntel486TM CPU task) 

6 80286 interrupt gate 

7 80286 trap gate 

C intel486TM CPU call gate 

E lntel486TM CPU interrupt gate 

F intel486TM CPU trap gate 

P Descriptor contents are not valid 

1 Descriptor contents are valid 

DPL — least privileged level at which a task may access the gate. WORD COUNT 0-31 — the number of parameters to copy from caller's stack 
to the called procedure's stack. The parameters are 32-bit quantities for lntel486TM CPU gates, and 16-bit quantities for 80286 gates. 
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DESTINATION 
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16-bit 
selector 



offset 

16-bit 80286 

32-bit lntel486TM CPU 



Selector to the target code segment 

or 

Selector to the target task state segment for task gate 

Entry point within the target code segment 



Figure 4.8. Gate Descriptor Formats 
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By supporting 80286 system segments the Intel486 
Microprocessor is able to execute 80286 application 
programs on an Intel486 Microprocessor operating 
system. This is possible because the processor au- 
tomatically understands which descriptors are 
80286-style descriptors and which descriptors are 
Intel486 Microprocessor-style descriptors. In partic- 
ular, if the upper word of a descriptor is zero, then 
that descriptor is a 80286-style descriptor. 

The only other differences between 80286-style de- 
scriptors and Intel486 Microprocessor descriptors is 
the interpretation of the word count field of call gates 
and the B bit. The word count field specifies the 
number of 16-bit quantities to copy for 80286 call 
gates and 32-blt quantities for Intel486 Microproces- 
sor call gates. The B bit controls the size of PUSHes 
when using a call gate; if B = PUSHes are 16 bits, 
if B = 1 PUSHes are 32 bits. 

4.3.4.8 Selector Fields 

A selector in Protected Mode has three fields: Local 
or Global Descriptor Table Indicator (Tl), Descriptor 



Entry Index (Index), and Requestor (the selector's) 
Privilege Level (RPL) as shown in Figure 4.10. The 
Tl bits select one of two memory-based tables of 
descriptors (the Global Descriptor Table or the Local 
Descriptor Table). The Index selects one of 8K de- 
scriptors In the appropriate descriptor table. The 
RPL bits allow high speed testing of the selector's 
privilege attributes. 

4.3.4.9 Segment Descriptor Cache 

In addition to the selector value, every segment reg- 
ister has a segment descriptor cache register asso- 
ciated with it. Whenever a segment register's con- 
tents are changed, the 8-byte descriptor associated 
with that selector is automatically loaded (cached) 
on the chip. Once loaded, all references to that seg- 
ment use the cached descriptor information instead 
of reaccessing the descriptor. The contents of the 
descriptor cache are not visible to the programmer. 
Since descriptor caches only change when a seg- 
ment register is changed, programs which modify 
the descriptor tables must reload the appropriate 
segment registers after changing a descriptor's val- 
ue. 
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Figure 4.9. 80286 Code and Data Segment Descriptors 
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Figure 4.10. Example Descriptor Selection 



4.3.4.10 Segment Descriptor Register Settings 

The contents of the segment descriptor cache vary 
depending on the mode the Intel486 Microprocessor 
is operating in. When operating in Real Address 
Mode, the segment base, limit, and other attributes 
within the segment cache registers are defined as 
shown in Figure 4.11 . For compatibility with the 8086 



architecture, the base is set to sixteen times the cur- 
rent selector value, the limit is fixed at OOOOFFFFH, 
and the attributes are fixed so as to indicate the seg- 
ment is present and fully usable. In Real Address 
Mode, the internal "privilege level" is always fixed to 
the highest level, level 0, so I/O and other privileged 
opcodes may be executed. 
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SEGMENT 



DESCRIPTOR CACHE REGISTER CONTENTS 



32 - BIT BASE 32 - BIT LIMIT OTHER AHRIBUTES 

(UPDATED DURING SELECTOR (FIXED) (FIXED) 

LOAD INTO SEGMENT REGISTER) 



CONFORMING PRIVILEGE - 

STACK SIZE 

EXECUTABLE 
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PRESENT 



BASE 



LIMIT 



cs 


16X CURRENT CS SELECTOR* 


GOOOFFFFH 


Y 





Y 


B 


U 


Y 


Y 


Y 


- 


N 


ss 


16X CURRENT SS SELECTOR 


GOOOFFFFH 


Y 





Y 


B 


U 


Y 


Y 


N 


W 


- 


DS 


16X CURRENT DS SELECTOR 


GOOOFFFFH 


Y 





Y 


B 


U 


Y 


Y 


N 


- 


- 


ES 


16X CURRENT ES SELECTOR 


GOOOFFFFH 


Y 





Y 


B 


U 


Y 


Y 


N 


- 


- 


FS 


16X CURRENT FS SELECTOR 


OOOOFFFFH 


Y 





Y 


B 


U 


Y 


Y 


N 


- 


- 


GS 


16X CURRENT GS SELECTOR 


ODOOFFFFH 


Y 





Y 


B 


U 


Y 


Y 


N 


- 


- 
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*Except the 32-blt CS base is initialized to FFFFFOOOH after reset until first intersegment control transfer (i.e., intersegment CALL, or 
intersegment JMP, or INT). (See Figure 4.13 Example.) 



Key: 



yes 

no 

privilege level 
■■ privilege level 1 

privilege level 2 
■■ privilege level 3 

expand up 



D = expand down 

B = byte granularity 

P = page granularity 

W = push/pop 16-bit words 

F = push/pop 32-bit dwords 

- = does not apply to that segment cache register 



Figure 4.1 1. Segment Descriptor Caches for Real Address Mode 
(Segment Limit and Attributes are Fixed) 



When operating in Protected Mode, the segment 
base, limit, and other attributes within the segment 
cache registers are defined as shown in Figure 4.12. 
In Protected Mode, each of these fields are defined 



according to the contents of the segment descriptor 
indexed by the selector value loaded Into the seg- 
ment register. 
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SEGMENT 

32 -BIT BASE 

(UPDATED DURING 

SELECTOR LOAD INTO 

SEGMENT REGISTER) 

CONFORMING PRIVILEGE - 

STACK SIZE 

EXECUTABLE 

WRITEABLE 

READABLE 



DESCRIPTOR CACHE REGISTER CONTENTS 



32 -BIT LIMIT 

(UPDATED DURING 

SELECTOR LOAD INTO 

SEGMENT REGISTER) 



OTHER AHRIBUTES 

(UPDATED DURING 

SELECTOR LOAD INTO 

SEGMENT REGISTER) 



EXPANSION DIRECTION - 

GRANULARITY 

ACCESSED 



PRIVILEGE LEVEL - 
PRESENT- 



BASE 



LIMIT 



m 



cs 


BASE PER SEG DESCR 


LIMIT PER SEG DESCR 


P 


d 


d 




d 


d 


N 


Y 


- 


d 


ss 


BASE PER SEG DESCR 


LIMIT PER SEG DESCR , 


P 


d 


d 




d 


r 


w 


N 


d 


- 


DS 


BASE PER SEG DESCR 


LIMIT PER SEG DESCR 


P 


d 


d 




d 


d 


d 


N 


- 


- 


ES 


BASE PER SEG DESCR 


LIMIT PER SEG DESCR 


P 


d 


d 




d 


d 


d 


N 


- 


- 


FS 


BASE PER SEG DESCR 


LIMIT PER SEG DESCR 


P 


d 


d 




d 


d 


d 


N 


- 


- 


GS 


BASE PER SEG DESCR 


LIMIT PER SEG DESCR 


P 


d 


d 




d 


d 


d 


N 


- 


- 



Key: 



Y = fixed yes 

N = fixed no 

d = per segment descriptor 

p = per segment descriptor; descriptor must indicate "present" to avoid exception 1 1 

(exception 12 in case of 83) 
r = per segment descriptor, but descriptor must indicate "readable" to avoid exception 13 

(special case for 88) 
w = per segment descriptor, but descriptor must indicate "writable" to avoid exception 13 

(special case for SS) 
- = does not apply to that segment cache register 
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Figure 4.12. Segment Descriptor Caches for Protected Mode (Loaded per Descriptor) 



When operating in a Virtual 8086 Mode within the 
Protected Mode, the segment base, limit, and other 
attributes within the segment cache registers are de- 
fined as shown in Figure 4.13. For compatibility with 
the 8086 architecture, the base is set to sixteen 
times the current selector value, the limit is fixed at 



OOOOFFFFH, and the attributes are fixed so as to 
indicate the segment is present and fully usable. The 
virtual program executes at lowest privilege level, 
level 3, to allow trapping of all lOPL-sensitive in- 
structions and level-0-only instructions. 
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SEGMENT 



DESCRIPTOR CACHE REGISTER CONTENTS 



32 - BIT BASE 



(UPDATED DURING SELECTOR 
LOAD INTO SEGMENT REGISTER) 



32 -BIT LIMIT 
(FIXED) 



OTHER AHRIBUTES 
(FIXED) 



CONFORMING PRIVILEGE - 

STACK SIZE 

EXECUTABLE 

WRITEABLE 

READABLE 

EXPANSION DIRECTION — 

GRANULARITY 

ACCESSED 

PRIVILEGE LEVEL 

PRESENT 



BASE 



LIMIT 



i\ 



cs 


16X CURRENT CS SELECTOR 


GOOOFFFFH 


Y 


3 


Y 


B 


U 


Y 


Y 


Y 


- 


N 


ss 


16X CURRENT SS SELECTOR 


GOOOFFFFH 


Y 


3 


Y 


B 


U 


Y 


Y 


N 


W 


- 


DS 


1 6X CURRENT DS SELECTOR 


GOOOFFFFH 


Y 


3 


Y 


B 


U 


Y 


Y 


N 


- 


- 


ES 


1 6X CURRENT ES SELECTOR 


OGGGFFFFH 


Y 


3 


Y 


B 


U 


Y 


Y 


N 


- 


- 


FS 


16X CURRENT FS SELECTOR 


GGGGFFFFH 


Y 


3 


Y 


B 


U 


Y 


Y 


N 


- 


- 


GS 


16X CURRENT GS SELECTOR 


OGGGFFFFH 


Y 


3 


Y 


B 


U 


Y 


Y 


N 


- 


- 
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Key: 



= yes 
= no 

= privilege level 

= privilege level 1 

= privilege level 2 

privilege level 3 



U = expand up 



D = expand down 

B = byte granularity 

P = page granularity 

W = push/pop 16-bit words 

F = push/pop 32-bit dwords 

- = does not apply to that segment cache register 



Figure 4.13. Segment Descriptor Caches for Virtual 8086 Mode within Protected Mode 
(Segment Limit and Attributes are Fixed) 



4.4 Protection 

4.4.1 PROTECTION CONCEPTS 
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The Intel486 Microprocessor has four levels of pro- 
tection which are optimized to support the needs of 
a multi-tasking operating system to isolate and pro- 
tect user programs from each other and the operat- 
ing system. The privilege levels control the use of 
privileged instructions, I/O instructions, and access 
to segments and segment descriptors. Unlike tradi- 
tional microprocessor-based systems where this 
protection is achieved only through the use of com- 
plex external hardware and software the Intel486 Mi- 
croprocessor provides the protection as part of its 
integrated Memory Management Unit. The Intel486 
Microprocessor offers an additional type of protec- 
tion on a page basis, when paging is enabled (See 
Section 4.5.3 Page Level Protection). 

The four-level hierarchical privilege system is illus- 
trated in Figure 4-14. It is an extension of the user/ 
supervisor privilege mode commonly used by mini- 
computers and, in fact, the user/supervisor mode is 
fully supported by the Intel486 Microprocessor pag- 



Flgure 4.14. Four-Level Hierarchical Protection 
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ing mechanism. The privilege levels (PL) are num- 
bered through 3. Level is the most privileged or 
trusted level. 



4.4.2 RULES OF PRIVILEGE 

The Intel486 Microprocessor controls access to 
both data and procedures between levels of a task, 
according to the following rules. 

• Data stored in a segment with privilege level p 
can be accessed only by code executing at a 
privilege level at least as privileged as p. 

• A code segment/procedure with privilege level p 
can only be called by a task executing at the 
same or a lesser privilege level than p. 

4.4.3 PRIVILEGE LEVELS 

4.4.3.1 Task Privilege 

At any point in time, a task on the Intel486 Micro- 
processor always executes at one of the four privi- 
lege levels. The Current Privilege Level (CPL) speci- 
fies the task's privilege level. A task's CPL may only 
be changed by control transfers through gate de- 
scriptors to a code segment with a different privilege 
level. (See Section 4.4.4 Privilege Level Transfers) 
Thus, an application program running at PL = 3 may 
call an operating system routine at PL = 1 (via a 
gate) which would cause the task's CPL to be set to 
1 until the operating system routine was finished. 

4.4.3.2 Selector Privilege (RPL) 

The privilege level of a selector is specified by the 
RPL field. The RPL is the two least significant bits of 
the selector. The selector's RPL is only used to es- 
tablish a less trusted privilege level than the current 
privilege level for the use of a segment This level Is 
called the task's effective privilege level (EPL). The 
EPL is defined as being the least privileged (i.e. nu- 
merically larger) level of a task's CPL and a selec- 
tor's RPL. Thus, if selector's RPL = then the CPL 
always specifies the privilege level for making an ac- 
cess using the selector. On the other hand if RPL = 
3 then a selector can only access segments at level 



3 regardless of the task's CPL. The RPL is most 
commonly used to verify that pointers passed to an 
operating system procedure do not access data that 
is of higher privilege than the procedure that origi- 
nated the pointer. Since the originator of a selector 
can specify any RPL value, the Adjust RPL (ARPL) 
instruction is provided to force the RPL bits to the 
originator's CPL. 

4.4.3.3 I/O Privilege and I/O Permission Bitmap 

The I/O privilege level (lOPL, a 2-bit field in the 
EFLAG register) defines the least privileged level at 
which I/O instructions can be unconditionally per- 
formed. I/O instructions can be unconditionally per- 
formed when CPL ^ lOPL. (The I/O instructions are 
IN, OUT, INS, OUTS, REP INS, and REP OUTS.) 
When CPL > lOPL, and the current task is associat- 
ed with a 286 TSS, attempted I/O instructions cause 
an exception 13 fault. When CPL > lOPL, and the 
current task is associated with an Intel486 Micro- 
processor TSS, the I/O Permission Bitmap (part of 
an Intel486 Microprocessor TSS) is consulted on 
whether I/O to the port is allowed, or an exception 
13 fault is to be generated instead. For diagrams of 
the I/O Permission Bitmap, refer to Figures 4.15a 
and 4.15b. For further information on how the I/O 
Permission Bitmap is used in Protected Mode or in 
Virtual 8086 Mode, refer to Section 4.6.4 Protection 
and I/O Permission Bitmap. 

The I/O privilege level (lOPL) also affects whether 
several other instructions can be executed or cause 
an exception 13 fault instead. These instructions are 
called "lOPL-sensitive" instructions and they are 
CLI and STI. (Note that the LOCK prefix is not lOPL- 
sensitive on the Intel486 Microprocessor.) 

The lOPL also affects whether the IF (interrupts en- 
able flag) bit can be changed by loading a value into 
the EFLAGS register. When CPL <. lOPL, then the 
IF bit can be changed by loading a new value into 
the EFLAGS register. When CPL > lOPL, the IF bit 
cannot be changed by a new value POP'ed into (or 
otherwise loaded into) the EFLAGS register; the IF 
bit merely remains unchanged and no exception is 
generated. 
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Table 4.2. Pointer Test Instructions 



Instruction 


Operands 


Function 


ARPL 


Selector, 
Register 


Adjust Requested Privi- 
lege Level: adjusts the 
RPL of the selector to the 
numeric maximum of 
current selector RPL value 
and the RPL value in the 
register. Set zero flag If 
selector RPL was 
changed. 


VERR 


Selector 


VERify for Read: sets the 
zero flag if the segment 
referred to by the selector 
can be read. 


VERW 


Selector 


VERify for Write: sets the 
zero flag if the segment 
referred to by the selector 
can be written. 


LSL 


Register, 
Selector 


Load Segment Limit: reads 
the segment limit into the 
register if privilege rules 
and descriptor type allow. 
Set zero flag if successful. 


LAR 


Register, 
Selector 


Load Access Rights: reads 
the descriptor access 
rights byte Into the register 
if privilege rules allow. Set 
zero flag if successful. 



4.4.3.4 Privilege Validation 

The Intel486 Microprocessor provides several in- 
structions to speed pointer testing and help maintain 
system integrity by verifying that the selector value 
refers to an appropriate segment. Table 4.2 summa- 
rizes the selector validation procedures available for 
the Intel486 Microprocessor. 

This pointer verification prevents the common prob- 
lem of an application at PL = 3 calling a operating 
systems routine at PL = and passing the operat- 
ing system routine a "bad" pointer which corrupts a 
data structure belonging to the operating system. If 
the operating system routine uses the ARPL instruc- 



tion to ensure that the RPL of the selector has no 
greater privilege than that of the caller, then this 
problem can be avoided. 

4.4.3.5 Descriptor Access 

There are basically two types of segment accesses: 
those involving code segments such as control 
transfers, and those involving data accesses. Deter- 
mining the ability of a task to access a segment in- 
volves the type of segment to be accessed, the in- 
struction used, the type of descriptor used and CPL, 
RPL, and DPL as described above. 

Any time an instruction loads data segment registers 
(DS, ES, FS, GS) the Intel486 Microprocessor 
makes protection validation checks. Selectors load- 
ed in the DS, ES, FS, GS registers must refer only to 
data segments or readable code segments. The 
data access rules are specified in Section 4.4.2 
Rules of Privilege. The only exception to those 
rules is readable conforming code segments which 
can be accessed at any privilege level. 

Finally the privilege validation checks are performed. 
The CPL is compared to the EPL and if the EPL is 
more privileged than the CPL an exception 13 (gen- 
eral protection fault) is generated. 

The rules regarding the stack segment are slightly 
different than those involving data segments. In- 
structions that load selectors into SS must refer to 
data segment descriptors for writeable data seg- 
ments. The DPL and RPL must equal the CPL. All 
other descriptor types or a privilege level violation 
will cause exception 13. A stack not present fault 
causes exception 1 2. Note that an exception 1 1 is 
used for a not-present code or data segment. 

4.4.4 PRIVILEGE LEVEL TRANSFERS 

Inter-segment control transfers occur when a selec- 
tor is loaded in the CS register. For a typical system 
most of these transfers are simply the result of a call 
or a jump to another routine. There are five types of 
control transfers which are summarized in Table 4.3. 
Many of these transfers result in a privilege level 
transfer. Changing privilege levels is done only via 
control transfers, by using gates, task switches, and 
interrupt or trap gates. 
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Table 4.3. Descriptor Types Used for Control Transfer 



Control Transfer Types 


Operation Types 


Descriptor 
Referenced 


Descriptor 
Table 


Intersegment within the same privilege level 


JMP, CALL, RET, IRET* 


Code Segment 


GDT/LDT 


Intersegment to the same or higher privilege level 
Interrupt within task may change CPL 


CALL 


Call Gate 


GDT/LDT 


Interrupt Instruction, 
Exception, External 
Interrupt 


Trap or 

Interrupt 

Gate 


IDT 


Intersegment to a lower privilege level 
(changes task CPL) 


RET, IRET* 


Code Segment 


GDT/LDT 




CALL, JMP 


Task State 
Segment 


GDT 


Task Switch 


CALL, JMP 


Task Gate 


GDT/LDT 


IRET** 

Interrupt Instruction, 
Exception, External 
Interrupt 


Task Gate 


IDT 



*NT (Nested Task bit of flag register) = 
**NT (Nested Task bit of flag register) = 1 

Control transfers can only occur if the operation 
which loaded the selector references the correct de- 
scriptor type. Any violation of these descriptor usage 
rules will cause an exception 13 (e.g. JMP through a 
call gate, or IRET from a normal subroutine call). 

In order to provide further system security, all control 
transfers are also subject to the privilege rules. 

The privilege rules require that: 

— Privilege level transitions can only occur via 
gates. 

— JMPs can be made to a non-conforming code 
segment with the same privilege or to a conform- 
ing code segment with greater or equal privilege. 

— CALLS can be made to a non-conforming code 
segment with the same privilege or via a gate to 
a more privileged level. 

— Interrupts handled within the task obey the same 
privilege rules as CALLs. 

— Conforming Code segments are accessible by 
privilege levels which are the same or less privi- 
leged than the conforming-code segment's DPL. 

— Both the requested privilege level (RPL) in the 
selector pointing to the gate and the task's CPL 
must be of equal or greater privilege than the 
gate's DPL 

— The code segment selected in the gate must be 
the same or more privileged than the task's CPL. 



— Return instructions that do not switch tasks can 
only return control to a code segment with same 
or less privilege. 

— Task switches can be performed by a CALL, 
JMP, or INT which references either a task gate 
or task state segment who's DPL Is less privi- 
leged or the same privilege as the old task's CPL. 

Any control transfer that changes CPL within a task 
causes a change of stacks as a result of the privi- 
lege level change. The initial values of SS:ESP for 
privilege levels 0, 1 , and 2 are retained in the task 
state segment (see Section 4.4.6 Task Switching). 
During a JMP or CALL control transfer, the new 
stack pointer is loaded into the SS and ESP regis- 
ters and the previous stack pointer is pushed onto 
the new stack. 

When RETurnIng to the original privilege level, use 
of the lower-privileged stack is restored as part of 
the RET or IRET instruction operation. For subrou- 
tine calls that pass parameters on the stack and 
cross privilege levels, a fixed number of words (as 
specified in the gate's word count field) are copied 
from the previous stack to the current stack. The 
inter-segment RET instruction with a stack adjust- 
ment value will correctly restore the previous stack 
pointer upon return. 
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Type = 
Type = 



9: Available lntel486TM CPU TSS, 
B: Busy lntel486TM CPU TSS 



Figure 4.15a. lntel486TM Microprocessor TSS and TSS Registers 
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Figure 4.15b. Sample I/O Permission Bit Map 



4.4.5 CALL GATES 



Gates provide protected, indirect CALLs. One of tiie 
major uses of gates is to provide a secure method of 
privilege transfers within a task. Since the operating 
system defines all of the gates in a system, it can 
ensure that all gates only allow entry into a few trust- 
ed procedures (such as those which allocate memo- 
ry, or perform I/O). 

Gate descriptors follow the data access rules of priv- 
ilege; that is, gates can be accessed by a task if the 
EPL, is equal to or more privileged than the gate 
descriptor's DPL Gates follow the control transfer 
rules of privilege and therefore may only transfer 
control to a more privileged level. 

Call Gates are accessed via a CALL instruction and 
are syntactically identical to calling a normal subrou- 
tine. When an inter-level Intel486 Microprocessor 
call gate is activated, the following actions occur. 

1. Load CS:EIP from gate check for validity 

2. SS is pushed zero-extended to 32 bits 

3. ESP is pushed 

4. Copy Word Count 32-bit parameters from the 
old stack to the new stack 

5. Push Return address on stack 

The procedure is identical for 80286 Call gates, ex- 
cept that 16-bit parameters are copied and 16-bit 
registers are pushed. 

Interrupt Gates and Trap gates work in a similar 
fashion as the call gates, except there is no copying 
of parameters. The only difference between Trap 
and Interrupt gates is that control transfers through 
an Interrupt gate disable further interrupts (i.e. the IF 
bit is set to 0), and Trap gates leave the interrupt 
status unchanged. 



address space, and a link to the previous task), 
loads a new execution state, performs protection 
checks, and commences execution in the new task, 
in about 10 microseconds. Like transfer of control 
via gates, the task switch operation is invoked by 
executing an inter-segment JMP or CALL Instruction 
which refers to a Task State Segment (TSS), or a 
task gate descriptor in the GDT or LDT. An INT n 
instruction, exception, trap, or external interrupt may 
also invoke the task switch operation if there is a 
task gate descriptor in the associated IDT descriptor 
slot. 

The TSS descriptor points to a segment (see Figure 
4.15) containing the entire Intel486 Microprocessor 
execution state while a task gate descriptor contains 
a TSS selector. The Intel486 Microprocessor sup- 
ports both 80286 and Intel486 Microprocessor style 
TSSs. Figure 4.16 shows a 80286 TSS. The limit of 
an Intel486 Microprocessor TSS must be greater 
than 0064H (002BH for a 80286 TSS), and can be 
as large as 4 Gigabytes. In the additional TSS 
space, the operating system is free to store addition- 
al information such as the reason the task is inac- 
tive, time the task has spent running, and open files 
belong to the task. 

Each task must have a TSS associated with it. The 
current TSS is identified by a special register in the 
Intel486 Microprocessor called the Task State Seg- 
ment Register (TR). This register contains a selector 
referring to the task state segment descriptor that 
defines the current TSS. A hidden base and limit 
register associated with TR are loaded whenever TR 
is loaded with a new selector. Returning from a task 
is accomplished by the IRET instruction. When IRET 
Is executed, control is returned to the task which 
was interrupted. The current executing task's state 
is saved in the TSS and the old task state is restored 
from its TSS. 



4.4.6 TASK SWITCHING 

A very important attribute of any multi-tasking/ multi- 
user operating systems is its ability to rapidly switch 
between tasks or processes. The Intel486 Micro- 
processor directly supports this operation by provid- 
ing a task switch instruction In hardware. The In- 
tel486 Microprocessor task switch operation saves 
the entire state of the machine (all of the registers, 



Several bits in the flag register and machine status 
word (CRO) give information about the state of a 
task which are useful to the operating system. The 
Nested Task (NT) (bit 14 in EFLAGS) controls the 
function of the IRET instruction. If NT = 0, the IRET 
instruction performs the regular return; when NT = 
1 , IRET performs a task switch operation back to the 
previous task. The NT bit is set or reset in the follow- 
ing fashion: 
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Figure 4.16. 80286 TSS 

When a CALL or INT instruction initiates a task 
switch, the new TSS will be marked busy and the 
back link field of the new TSS set to the old TSS 
selector. The NT bit of the new task is set by CALL 
or INT initiated task switches. An interrupt that does 
not cause a task switch will clear NT. (The NT bit will 
be restored after execution of the interrupt handler) 
NT may also be set or cleared by POPF or IRET 
instructions. 

The Intel486 Microprocessor task state segment is 
marked busy by changing the descriptor type field 
from TYPE 9H to TYPE BH. An 80286 TSS is 
marked busy by changing the descriptor type field 
from TYPE 1 to TYPE 3. Use of a selector that refer- 
ences a busy task state segment causes an excep- 
tion 13. 

The Virtual Mode (VM) bit 17 is used to indicate if a 
task, is a virtual 8086 task. If VM = 1 , then the tasks 
will use the Real Mode addressing mechanism. The 
virtual 8086 environment Is only entered and exited 
via a task switch (see Section 4.6 Virtual l\/lode). 

The FPU's state is not automatically saved when a 
task switch occurs, because the incoming task may 
not use the FPU. The Task Switched (TS) Bit (bit 3 in 
the CRO) helps deal with the FPU's state in a multi- 
tasking environment. Whenever the Intel486 Micro- 



processor switches tasks, it sets the TS bit. The In- 
tel486 Microprocessor detects the first use of a 
processor extension instruction after a task switch 
and causes the processor extension not available 
exception 7. The exception handler for exception 7 
may then decide whether to save the state of the 
FPU. A processor extension not present exception 
(7) will occur when attempting to execute a Floating 
Point or WAIT instruction if the Task Switched and 
Monitor coprocessor extension bits are both set (i.e. 
TS = 1 and MP = 1). 

The T bit in the Intel486 Microprocessor TSS indi- 
cates that the processor should generate a debug 
exception when switching to a task. If T = 1 then 
upon entry to a new task a debug exception 1 will be 
generated. 

4.4.7 INITIALIZATION AND TRANSITION TO 
PROTECTED iVIODE 

Since the Intel486 Microprocessor begins executing 
in Real Mode immediately after RESET it is neces- 
sary to initialize the system tables and registers with 
the appropriate values. 

The GDT and IDT registers must refer to a valid GDT 
and IDT. The IDT should be at least 256 bytes long, 
and GDT must contain descriptors for the initial 
code, and data segments. Figure 4.17 shows the ta- 
bles and Figure 4.18 the descriptors needed for a 
simple Protected Mode Intel486 Microprocessor 
system. It has a single code and single data/stack 
segment each four gigabytes long and a single privi- 
lege level PL = 0. 

The actual method of enabling Protected Mode is to 
load CRO with the PE bit set, via the MOV CRO, R/M 
instruction. This puts the Intel486 Microprocessor in 
Protected Mode. 

After enabling Protected Mode, the next instruction 
should execute an intersegment JMP to load the CS 
register and flush the instruction decode queue. The 
final step is to load all of the data segment registers 
with the initial selector values. 

An alternate approach to entering Protected Mode 
which is especially appropriate for multi-tasking op- 
erating systems, is to use the built in task-switch to 
load all of the registers. In this case the GDT would 
contain two TSS descriptors in addition to the code 
and data descriptors needed for the first task. The 
first JMP instruction in Protected Mode would jump 
to the TSS causing a task switch and loading all of 
the registers with the values stored in the TSS. The 
Task State Segment Register should be initialized to 
point to a valid TSS descriptor since a task switch 
saves the state of the current task in a task state 
segment. 
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Figure 4.17. Simple Protected System 
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Figure 4.18. GDT Descriptors for Simple System 



4.4.8 TOOLS FOR BUILDING PROTECTED 
SYSTEMS 

In order to simplify the design of a protected multi- 
tasking system, Intel provides a tool which allows 
the system designer an easy method of constructing 
the data structures needed for a Protected Mode 
Intel486 Microprocessor system. This tool is the 
builder BLD-386TM. BLD-386 lets the operating sys- 
tem writer specify all of the segment descriptors dis- 
cussed in the previous sections (LDTs, IDTs, GDTs, 
Gates, and TSSs) in a high-level language. 



4.5 Paging 

4.5.1 PAGING CONCEPTS 

Paging is another type of memory management 
useful for virtual memory multitasking operating sys- 
tems. Unlike segmentation which modularizes pro- 
grams and data into variable length segments, pag- 
ing divides programs into multiple uniform size 
pages. Pages bear no direct relation to the logical 
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Structure of a program. While segment selectors can 
be considered the logical "name" of a program 
module or data structure, a page most likely corre- 
sponds to only a portion of a module or data struc- 
ture. 

By taking advantage of the locality of reference dis- 
played by most programs, only a small number of 
pages from each active task need be in memory at 
any one moment. 

4.5.2 PAGING ORGANIZATION 

4.5.2.1 Page Mechanism 

The Intel486 Microprocessor uses two levels of ta- 
bles to translate the linear address (from the seg- 
mentation unit) into a physical address. There are 
three components to the paging mechanism of the 
Intel486 Microprocessor: the page directory, the 
page tables, and the page itself (page frame). All 
memory-resident elements of the Intel486 Micro- 
processor paging mechanism are the same size, 
namely, 4 Kbytes. A uniform size for all of the ele- 
ments simplifies memory allocation and reallocation 
schemes, since there is no problem with memory 
fragmentation. Figure 4.19 shows how the paging 
mechanism works. 



4.5.2.2 Page Descriptor Base Register 

CR2 is the Page Fault Linear Address register. It 
holds the 32-bit linear address which caused the last 
page fault detected. 

CR3 is the Page Directory Physical Base Address 
Register. It contains the physical starting address of 
the Page Directory. The lower 12 bits of CR3 are 
always zero to ensure that the Page Directory is al- 
ways page aligned. Loading it via a MOV CR3, reg 
instruction causes the Page Table Entry cache to be 
flushed, as will a task switch through a TSS which 
changes the value of CRO. (See 4.5.5 Translation 
Loolcaside Buffer). 



4.5.2.3 Page Directory 

The Page Directory is 4 Kbytes long and allows up to 
1024 Page Directory Entries. Each Page Directory 
Entry contains the address of the next level of ta- 
bles, the Page Tables and information about the 
page table. The contents of a Page Directory Entry 
are shown in Figure 4.20. The upper 1 bits of the 
linear address (A22-A31) are used as an index to 
select the correct Page Directory Entry. 





TWO LEVEL PAGING SCHEME 
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Figure 4.19. Paging Meclianism 
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Figure 4.20. Page Directory Entry (Points to Page Table) 
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Figure 4.21. Page Table Entry (Points to Page) 



4.5.2.4 Page Tables 



Each Page Table is 4 Kbytes and holds up to 1 024 
Page Table Entries. Page Table Entries contain the 
starting address of the page frame and statistical 
information about the page (see Figure 4.21). Ad- 
dress bits A12-A21 are used as an index to select 
one of the 1 024 Page Table Entries. The 20 upper- 
bit page frame address is concatenated with the 
lower 12 bits of the linear address to form the physi- 
cal address. Page tables can be shared between 
tasks and swapped to disks. 

4.5.2.5 Page Directory /Table Entries 

The lower 12 bits of the Page Table Entries and 
Page Directory Entries contain statistical information 
about pages and page tables respectively. The P 
(Present) bit indicates if a Page Directory or Page 
Table entry can be used in address translation. If 
P = 1 the entry can be used for address translation 
if P = the entry can not be used for translation, 
and all of the other bits are available for use by the 
software. For example the remaining 31 bits could 
be used to indicate where on the disk the page is 
stored. 

The A (Accessed) bit 5, is set by the Intel486 Micro- 
processor for both types of entries before a read or 
write access occurs to an address covered by the 
entry. The D (Dirty) bit 6 is set to 1 before a write to 
an address covered by that page table entry occurs. 
The D bit is undefined for Page Directory Entries. 
When the P, A and D bits are updated by the In- 
tel486 Microprocessor, the processor generates a 
Read-Modify-Write cycle which locks the bus and 
prevents conflicts with other processors or perpheri- 
als. Software which modifies these bits should use 
the LOCK prefix to ensure the integrity of the page 
tables in multi-master systems. 

The 3 bits marked OS Reserved in Figure 4.20 and 
Figure 4.21 (bits 9-11) are software definable. OSs 
are free to use these bits for whatever purpose they 
wish. An example use of the OS Reserved bits 
would be to store information about page aging. By 
keeping track of how long a page has been in mem- 
ory since being accessed, an operating system can 
implement a page replacement algorithm like Least 
Recently Used. 



The (User/Supervisor) U/S bit 2 and the (Read/ 
Write) R/W bit 1 are used to provide protection attri- 
butes for individual pages. 

4.5.3 PAGE LEVEL PROTECTION 
(R/W, U/S BITS) 

The Intel486 Microprocessor provides a set of pro- 
tection attributes for paging systems. The paging 
mechanism distinguishes between two levels of pro- 
tection: User which corresponds to level 3 of the 
segmentation based protection, and supervisor 
which encompasses all of the other protection levels 
(0,1,2). 

The R/W and U/S bits are used in conjunction with 
the WP bit in the flags register (EFLAGS). The 386 
Microprocessor does not contain the WP bit. The 
WP bit has been added to the Intel486 Microproces- 
sor to protect read-only pages from supervisor write 
accesses. The 386 Microprocessor allows a read- 
only page to be written from protection levels 0, 1 or 
2. WP = is the 386 Microprocessor compatible 
mode. When WP = the supervisor can write to a 
read-only page as defined by the U/S and R/W bits. 
When WP = 1 supervisor access to a read-only page 
(R/W = 0) will cause a page fault (exception 14). 

Table 4.4 shows the affect of the WP, U/S and R/W 
bits on accessing memory. When WP = 0, the super- 
visor can write to pages regardless of the state of 
the R/W bit. When WP = 1 and R/W = the supervi- 
sor cannot write to a read-only page. A user attempt 
to access a supervisor only page (U/S = 0), or write 
to a read only page will cause a page fault (excep- 
tion 14). 

The R/W and U/S bits provide protection from user 
access on a page by page basis since the bits are 
contained in the Page Table Entry and the Page Di- 
rectory Table. The U/S and R/W bits in the first level 
Page Directory Table apply to all entries in the page 
table pointed to by that directory entry. The U/S and 
R/W bits in the second level Page Table Entry apply 
only to the page described by that entry. The most 
restrictive of the U/S and R/W bits from the Page 
Directory Table and the Page Table Entry are used 
to address a page. 

Example: If the U/S and R/W bits for the Page Di- 
rectory entry were 10 (user read/execute) and the 
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U/S and R/W bits for the Page Table Entry were 01 
(no user access at all), the access rights for the 
page would be 01, the numerically smaller of the 
two. 

Note that a given segment can be easily made read- 
only for level 0, 1 or 2 via use of segmented protec- 
tion mechanisms. (Section 4.4 Protection). 

4.5.4 PAGE CACHEABILITY 
(PWT AND PCD BITS) 

PWT (page write through) and PCD (page cache dis- 
able) are two new bits defined in entries in both lev- 
els of the page table structure, the Page Directory 
Table and the Page Table Entry. PCD and PWT con- 
trol page cacheability and write policy. 

PWT controls write policy. PWT=1 defines a write- 
through policy for the current page. PWT=0 allows 
the possibility of write-back. PWT is ignored internal- 
ly because the Intel486 microprocessor has a write- 
through cache. PWT can be used to control the write 
policy of a second level cache. 

PCD controls cacheability. PCD = enables caching 
in the on-chip cache. PCD alone does not enable 
caching, it must be conditioned by the KEN# (cache 
enable) input signal and the state of the CD (cache 
disable bit) and NW (no write-through) bits in control 
register (CRO). When PCD= 1, caching is disabled 
regardless of the state of KEN#, CD and NW. (See 
Section 5.0, On-Chip Cache). 

The state of the PCD and PWT bits are driven out on 
the PCD and PWT pins during a memory access. 

The PWT and PCD bits for a bus cycle are obtained 
either from control register 3 (CR3), the Page Direc- 
tory Entry or the Page Table Entry, depending on the 
type of cycle run. However, when paging is disabled 
(PG = in CRO) or for cycles which bypass paging 
(i.e., I/O (input/output) references, INTR (interrupt 
request) and HALT cycles), the PCD and PWT bits 
of CR3 are ignored. The Intel486 CPU assumes PCD 
= and PWT = and drives these values on the 
PCD and PWT pins. 



When paging is enabled (PG = 1 in CRO), the bits 
from the page table entry are cached in the transla- 
tion lookaside buffer (TLB), and are driven any time 
the page mapped by the TLB entry is referenced. 
For normal memory cycles run with paging enabled, 
the PWT and PCD bits are taken from the Page Ta- 
ble Entry. During TLB refresh cycles when the Page 
Directory and Page Table entries are read, the PWT 
and PCD bits must be obtained elsewhere. The bits 
are taken from CR3 when a Page Directory Entry is 
being read. The bits are taken from the Page Direc- 
tory Entry when the Page Table Entry is being updat- 
ed. 

The PCD or PWT bits in CR3 are initialized to zero at 
reset, but can be set to any value by level soft- 
ware. 

4.5.5 TRANSLATION LOOKASIDE BUFFER 

The Intel486 Microprocessor paging hardware is de- 
signed to support demand paged virtual memory 
systems. However, performance would degrade 
substantially if the processor was required to access 
two levels of tables for every memory reference. To 
solve this problem, the Intel486 Microprocessor 
keeps a cache of the most recently accessed pages, 
this cache is called the Translation Lookaside Buffer 
(TLB). The TLB is a four-way set associative 32-en- 
try page table cache. It automatically keeps the most 
commonly used Page Table Entries in the proces- 
sor. The 32-entry TLB coupled with a 4K page size, 
results in coverage of 128 Kbytes of memory ad- 
dresses. For many common multi-tasking systems, 
the TLB will have a hit rate of about 98%. This 
means that the processor will only have to access 
the two-level page structure on 2% of all memory 
references. Figure 4.22 illustrates how the TLB com- 
plements the Intel486 Microprocessor's paging 
mechanism. 

Reading a new entry into the TLB (TLB refresh) is a 
two step process handled by the Intel486 microproc- 
essor hardware. The sequence of data cycles to per- 
form a TLB refresh are: 
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1 . Read the correct Page Directory Entry, as point- 
ed to by the page base register and the upper 
10 bits of the linear address. The page base 
register is in control register 3. 

1a. Optionally perform a locked read/write to set 
the accessed bit in the directory entry. The di- 
rectory entry will actually get read twice if the 
Intel486 Microprocessor needs to set any of the 
bits in the entry. If the page directory entry 
changes between the first and second reads, 
the data returned for the second read will be 
used. 

2. Read the correct entry in the Page Table and 
place the entry in the TLB. 

2a. Optionally perform a locked read/write to set 
the accessed and/or dirty bit in the page table 
entry. Again, note that the page table entry will 
actually get read twice if the Intel486 Microproc- 
essor needs to set any of the bits in the entry. 
Like the directory entry, If the data changes be- 
tween the first and second read the data re- 
turned for the second read will be used. 

Note that the directory entry must always be read 
into the processor, since directory entries are never 
placed in the paging TLB. Page faults can be sig- 
naled from either the page directory read or the 
page table read. Page directory and page table en- 
tries may be placed In the Intel486 on-chip cache 
just like normal data. 



However, if the page table entry is not in the TLB, 
the Intel486 Microprocessor will read the appropri- 
ate Page Directory Entry. If P = 1 on the Page Di- 
rectory Entry Indicating that the page table is in 
memory, then the Intel486 Microprocessor will read 
the appropriate Page Table Entry and set the Ac- 
cess bit. If P = 1 on the Page Table Entry indicating 
that the page is in memory, the Intel486 Microproc- 
essor will update the Access and Dirty bits as need- 
ed and fetch the operand. The upper 20 bits of the 
linear address, read from the page table, will be 
stored in the TLB for future accesses. However, if 
P = for either the Page Directory Entry or the 
Page Table Entry, then the processor will generate a 
page fault, an Exception 14. 

The processor will also generate an exception 14 
page fault, if the memory reference violated the 
page protection attributes (i.e., U/S or R/W) (e.g., 
trying to write to a read-only page). CR2 will hold the 
linear address which caused the page fault. If a sec- 
ond page fault occurs, while the processor is at- 
tempting to enter the service routine for the first, 
then the processor will invoke the page fault (excep- 
tion 14) handler a second time, rather than the dou- 
ble fault (exception 8) handler. Since Exception 1 4 is 
classified as a fault, CS: EIP will point to the instruc- 
tion causing the page fault. The 16-bit error code 
pushed as part of the page fault handler will contain 
status bits which indicate the cause of the page 
fault. 



4.5.6 PAGING OPERATION 
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Figure 4.22. Translation Lookaside Buffer 

The paging hardware operates in the following fash- 
ion. The paging unit hardware receives a 32-bit lin- 
ear address from the segmentation unit The upper 
20 linear address bits are compared with all 32 en- 
tries in the TLB to determine If there is a match. If 
there is a match (i.e., a TLB hit), then the 32-bit 
physical address is calculated and will be placed on 
the address bus. 



The 16-bit error code is used by the operating sys- 
tem to determine how to handle the page fault. Fig- 
ure 4.23a shows the format of the page-fault error 
code and the interpretation of the bits. 

NOTE: 

Even though the bits in the error code (U/S, W/R, 
and P) have similar names as the bits in the Page 
Directory/Table Entries, the interpretation of the er- 
ror code bits is different. Figure 4.23b indicates 
what type of access caused the page fault. 
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Figure 4.23a. Page Fault Error Code Format 

U/S: The U/S bit indicates whether the access 
causing the fault occurred when the processor was 
executing in User Mode (U/S = 1) or in Supervisor 
mode (U/S = 0). 

W/R: The W/R bit indicates whether the access 
causing the fault was a Read (W/R = 0) or a Write 
(W/R = 1). 
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P: The P bit indicates whether a page fault was 
caused by a not-present page (P = 0), or by a page 
level protection violation (P = 1). 

U: UNDEFINED 



u/s 


W/R 


Access Type 





1 
1 




1 



1 


Supervisor* Read 
Supervisor Write 
User Read 
User Write 



* Descriptor table access will fault with U/S = 0, even if the program 
Is executing at level 3. 

Figure 4.23b. Type of Access 
Causing Page Fault 

4.5.7 OPERATING SYSTEM RESPONSIBILITIES 

The Intel486 Microprocessor takes care of the page 
address translation process, relieving the burden 
from an operating system in a demand-paged sys- 
tem. The operating system is responsible for setting 
up the initial page tables, and handling any page 
faults. The operating system also is required to inval- 
idate (i.e., flush) the TLB when any changes are 
made to any of the page table entries. The operating 
system must reload CR3 to cause the TLB to be 
flushed. 

Setting up the tables is simply a matter of loading 
CR3 with the address of the Page Directory, and 
allocating space for the Page Directory and the 
Page Tables. The primary responsibility of the oper- 
ating system is to implement a swapping policy and 
handle ail of the page faults. 

A final concern of the operating system is to ensure 
that the TLB cache matches the information in the 
paging tables. In particular, any time the operating 
system sets the P present bit of page table entry to 
zero, the TLB must be flushed. Operating systems 
may want to take advantage of the fact that CR3 is 
stored as part of a TSS, to give every task or group 
of tasks its own set of page tables. 



4.6 Virtual 8086 Environment 

4.6.1 EXECUTING 8086 PROGRAMS 

The Intel486 Microprocessor allows the execution of 
8086 application programs in both Real Mode and in 
the Virtual 8086 Mode (Virtual Mode). Of the two 
methods, Virtual 8086 Mode offers the system de- 
signer the most flexibility. The Virtual 8086 Mode al- 
lows the execution of 8086 applications, while still 
allowing the system designer to take full advantage 
of the Intel486 Microprocessor protection mecha- 



nism. In particular, the Intel486 Microprocessor al- 
lows the simultaneous execution of 8086 operating 
systems and Its applications, and an Intel486 Micro- 
processor operating system and both 80286 and In- 
tel486 Microprocessor applications. Thus, in a multi- 
user Intel486 Microprocessor computer, one person 
could be running an MS-DOS spreadsheet, another 
person using MS-DOS, and a third person could be 
running multiple Unix utilities and applications. Each 
person in this scenario would believe that he had the 
computer completely to himself. Figure 4.24 illus- 
trates this concept. 

4.6.2 VIRTUAL 8086 MODE ADDRESSING 
MECHANISM 

One of the major differences between Intel486 Mi- 
croprocessor Real and Protected modes Is how the 
segment selectors are interpreted. When the proc- 
essor is executing In Virtual 8086 Mode the segment 
registers are used in an identical fashion to Real 
Mode. The contents of the segment register is shift- 
ed left 4 bits and added to the offset to form the 
segment base linear address. 

The Intel486 Microprocessor allows the operating 
system to specify which programs use the 8086 
style address mechanism, and which programs use 
Protected Mode addressing, on a per task basis. 
Through the use of paging, the one megabyte ad- 
dress space of the Virtual Mode task can be mapped 
to anywhere in the 4 gigabyte linear address space 
of the Intel486 Microprocessor. Like Real Mode, Vir- 
tual Mode effective addresses (i.e., segment offsets) 
that exceed 64 Kbyte will cause an exception 13. 
However, these restrictions should not prove to be 
important, because most tasks running in Virtual 
8086 Mode will simply be existing 8086 application 
programs. 

4.6.3 PAGING IN VIRTUAL MODE 

The paging hardware allows the concurrent running 
of multiple Virtual Mode tasks, and provides protec- 
tion and operating system isolation. Although it is 
not strictly necessary to have the paging hardware 
enabled to run Virtual Mode tasks, it is needed in 
order to run multiple Virtual Mode tasks or to relo- 
cate the address space of a Virtual Mode task to 
physical address space greater than one megabyte. 

The paging hardware allows the 20-bit linear ad- 
dress produced by a Virtual Mode program to be 
divided into up to 256 pages. Each one of the pages 
can be located anywhere within the maximum 4 gig- 
abyte physical address space of the Intel486 Micro- 
processor. In addition, since CR3 (the Page Directo- 
ry Base Register) is loaded by a task switch, each 
Virtual Mode task can use a different mapping 
scheme to map pages to different physical locations. 
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Finally, the paging hardware allows the sharing of 
the 8086 operating system code between multiple 
8086 applications. Figure 4.24 shows how the In- 
tel486 Microprocessor paging hardware enables 
multiple 8086 programs to run under a virtual memo- 
ry demand paged system. 



4.6.4 



PROTECTION AND I/O PERMISSION 
BITMAP 



All Virtual 8086 Mode programs execute at privilege 
level 3, the level of least privilege. As such, Virtual 
8086 Mode programs are subject to all of the protec- 
tion checks defined in Protected Mode. (This is dif- 
ferent from Real Mode which Implicitly is executing 
at privilege level 0, the level of greatest privilege.) 
Thus, an attempt to execute a privileged Instruction 
when in Virtual 8086 Mode will cause an exception 
13 fault. 

The following are privileged instructions, which may 
be executed only at Privilege Level 0. Therefore, at- 
tempting to execute these instructions in Virtual 
8086 Mode (or anytime CPL > 0) causes an excep- 
tion 13 fault: 



LIDT; 


MOV 


DRn,reg; 


MOV 


reg,DRn; 


LGDT ; 


MOV 


TRn,reg; 


MOV 


reg,TRn; 


LMSW; 


MOV 


CRn,reg; 


MOV 


reg,CRn. 


CLTS; 










HLT; 











Several instructions, particularly those applying to 
the multitasking model and protection model, are 
available only in Protected Mode. Therefore, at- 
tempting to execute the following instructions in 
Real Mode or in Virtual 8086 Mode generates an 
exception 6 fault: 



LTR; 


STR; 


LLDT; 


SLDT; 


LAR; 


VERR ; 


LSL; 


VERW; 


ARPL. 





The instructions which are lOPL-sensitive in Protect- 
ed Mode are: 



IN; 


STI; 


OUT; 


CLI 


INS; 




OUTS; 




REP INS; 




REP OUTS; 
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Figure 4.24. Virtual 8086 Environment Memory Management 
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In Virtual 8086 Mode, a slightly different set of in- 
structions are made lOPL-sensitlve. The following in- 
structions are lOPL-sensitive In Virtual 8086 Mode: 



INT n; 
PUSHF ; 
POPF; 



STI; 
CLI; 
IRET 



The PUSHF, POPF, and IRET instructions are lOPL- 
sensitive in Virtual 8086 Mode only. This provision 
allows the IF flag (interrupt enable flag) to be virtual- 
ized to the Virtual 8086 Mode program. The INT n 
software interrupt instruction Is also lOPL-sensitive 
in Virtual 8086 Mode. Note, however, that the INT 3 
(opcode OCCH), INTO, and BOUND instructions are 
not lOPL-sensitive in Virtual 8086 mode (they aren't 
lOPL sensitive in Protected Mode either). 

Note that the I/O instructions (IN, OUT, INS, OUTS, 
REP INS, and REP OUTS) are not lOPL-sensitive in 
Virtual 8086 mode. Rather, the I/O instructions be- 
come automatically sensitive to the I/O Permission 
Bitmap contained in the Intel486 Microprocessor 
Task State Segment. The I/O Permission Bitmap, 
automatically used by the Intel486 Microprocessor 
in Virtual 8086 Mode, is illustrated by Figures 4.15a 
and 4.15b. 

The I/O Permission Bitmap can be viewed as a 0- 
64 Kbit bit string, which begins in memory at offset 
Bit__Map_Offset in the current TSS. Bit_Map_ 
Offset must be <. DFFFH so the entire bit map and 
the byte FFH which follows the bit map are all at 
offsets ^ FFFFH from the TSS base. The 16-bit 

pointer Bit Map Offset (1 5:0) is found in the word 

beginning at offset 66H (102 decimal) from the TSS 
base, as shown in Figure 4.15a. 

Each bit in the I/O Permission Bitmap corresponds 
to a single byte-wide I/O port, as illustrated in Figure 
4.15a. If a bit is 0, I/O to the corresponding byte- 
wide port can occur without generating an excep- 
tion. Otherwise the I/O instruction causes an excep- 
tion 13 fault. Since every byte-wide I/O port must be 
protectable, all bits corresponding to a word-wide or 
dword-wide port must be for the word-wide or 
dword-wide I/O to be permitted. If all the referenced 
bits are 0, the I/O will be allowed. If any referenced 
bits are 1 , the attempted I/O will cause an exception 
13 fault. 

Due to the use of a pointer to the base of the I/O 
Permission Bitmap, the bitmap may be located any- 
where within the TSS, or may be ignored completely 

by pointing the Bit Map Offset (15:0) beyond the 

limit of the TSS segment. In the same manner, only 
a small portion of the 64K I/O space need have an 
associated map bit, by adjusting the TSS limit to 
truncate the bitmap. This eliminates the commitment 
of 8K of memory when a complete bitmap is not 
required, while allowing the fully general case if de- 
sired. 



EXAMPLE OF BITMAP FOR I/O PORTS 0-255: 
Setting the TSS limit to ( bit_Map_Offset + 31 
+ 1**1 [** see note below] will allow a 32-byte bit- 
map for the I/O ports #0-255, plus a terminator 
byte of all 1's [** see note below]. This allows the 
I/O bitmap to control I/O Permission to I/O port 0- 
255 while causing an exception 1 3 fault on attempt- 
ed I/O to any I/O port 80256 through 65,565. 

** IMPORTANT IMPLEMENTATION NOTE: Beyond 
the last byte of I/O mapping information in the I/O 
Permission Bitmap must be a byte containing all 1 's. 
The byte of all 1's must be within the limit of the 
Intel486 Microprocessor TSS segment (see Figure 
4.15a). 

4.6.5 INTERRUPT HANDLING 

In order to fully support the emulation of an 8086 
machine, interrupts in Virtual 8086 Mode are han- 
dled in a unique fashion. When running in Virtual 
Mode all interrupts and exceptions involve a privi- 
lege change back to the host Intel486 Microproces- 
sor operating system. The Intel486 Microprocessor 
operating system determines if the interrupt comes 
from a Protected Mode application or from a Virtual 
Mode program by examining the VM bit in the 
EFLAGS image stored on the stack. 

When a Virtual Mode program is interrupted and ex- 
ecution passes to the interrupt routine at level 0, the 
VM bit is cleared. However, the VM bit is still set in 
the EFLAG image on the stack. 

The Intel486 Microprocessor operating system in 
turn handles the exception or interrupt and then re- 
turns control to the 8086 program. The Intel486 Mi- 
croprocessor operating system may choose to let 
the 8086 operating system handle the interrupt or it 
may emulate the function of the interrupt handler. 
For example, many 8086 operating system calls are 
accessed by PUSHIng parameters on the stack, and 
then executing an INT n instruction. If the lOPL is set 
to then all INT n instructions will be intercepted by 
the Intel486 Microprocessor operating system. The 
Intel486 Microprocessor operating system could em- 
ulate the 8086 operating system's call. Figure 4.25 
shows how the Intel486 Microprocessor operating 
system could intercept an 8086 operating system's 
call to "Open a File". 

An Intel486 Microprocessor operating system can 
provide a Virtual 8086 Environment which is totally 
transparent to the application software via intercept- 
ing and then emulating 8086 operating system's 
calls, and Intercepting IN and OUT instructions. 
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4.6.6 ENTERING AND LEAVING VIRTUAL 
8086 MODE 

Virtual 8086 mode is entered by executing an IRET 
instruction (at CPL=0), or Task Switch (at any CPL) 
to an Intel486 Microprocessor task whose Intel486 
Microprocessor TSS has a FLAGS image containing 
a 1 in the VM bit position while the processor is exe- 
cuting in Protected Mode. That is, one way to enter 
Virtual 8086 mode is to switch to a task with an In- 
tel486 Microprocessor TSS that has a 1 in the VM 
bit in the EFLAGS image. The other way is to exe- 
cute a 32-bit IRET instruction at privilege level 0, 
where the stack has a 1 In the VM bit in the EFLAGS 
image. POPF does not affect the VM bit, even if the 
processor is in Protected Mode or level 0, and so 
cannot be used to enter Virtual 8086 Mode. PUSHF 
always pushes a in the VM bit, even if the proces- 
sor is in Virtual 8086 Mode, so that a program can- 
not tell if it is executing in REAL mode, or in Virtual 
8086 mode. 

The VM bit can be set by executing an IRET instruc- 
tion only at privilege level 0, or by any instruction or 
Interrupt which causes a task switch in Protected 
Mode (with VM = 1 in the new FLAGS image), and 
can be cleared only by an interrupt or exception in 
Virtual 8086 Mode. IRET and POPF instructions exe- 
cuted in REAL mode or Virtual 8086 mode will not 
change the value in the VM bit. 

The transition out of virtual 8086 mode to Intel486 
Microprocessor protected mode occurs only on re- 
ceipt of an interrupt or exception (such as due to a 
sensitive instruction). In Virtual 8086 mode, all inter- 
rupts and exceptions vector through the protected 
mode IDT, and enter an interrupt handler in protect- 
ed Intel486 Microprocessor mode. That is, as part of 
interrupt processing, the VM bit is cleared. 

Because the matching IRET must occur from level 0, 
if an Interrupt or Trap Gate is used to field an inter- 
rupt or exception out of Virtual 8086 mode, the Gate 
must perform an inter-level interrupt only to level 0. 
Interrupt or Trap Gates through conforming seg- 
ments, or through segments with DPL>0, will raise a 
GP fault with the CS selector as the error code. 



4.6.6.1 Task Switches To/From Virtual 
8086 Mo6e 

Tasks which can execute In virtual 8086 mode must 
be described by a TSS with the new Intel486 Micro- 
processor format (TYPE 9 or 11 descriptor). 

A task switch out of virtual 8086 mode will operate 
exactly the same as any other task switch out of a 
task with an Intel486 Microprocessor TSS. All of the 
programmer visible state, including the FLAGS reg- 
ister with the VM bit set to 1 , is stored in the TSS. 



The segment registers in the TSS will contain 8086 
segment base values rather than selectors. 

A task switch into a task described by an Intel486 
Microprocessor TSS will have an additional check to 
determine if the incoming task should be resumed in 
virtual 8086 mode. Tasks described by 80286 format 
TSSs cannot be resumed in virtual 8086 mode, so 
no check is required there (the FLAGS image in 
80286 format TSS has only the low order 16 FLAGS 
bits). Before loading the segment register images 
from an Intel486 Microprocessor TSS, the FLAGS 
image is loaded, so that the segment registers are 
loaded from the TSS image as 8086 segment base 
values. The task is now ready to resume in virtual 
8086 execution mode. 



4.6.6.2 Transitions Through Trap and Interrupt 
Gates, and IRET 

A task switch is one way to enter or exit virtual 8086 
mode. The other method is to exit through a Trap or 
Interrupt gate, as part of handling an interrupt, and 
to enter as part of executing an IRET instruction. 
The transition out must use an Intel486 Microproc- 
essor Trap Gate (Type 14), or Intel486 Microproces- 
sor Interrupt Gate (Type 15), which must point to a 
non-conforming level segment (DPL=0) in order 
to permit the trap handler to IRET back to the Virtual 
8086 program. The Gate must point to a non-con- 
forming level segment to perform a level switch to 
level so that the matching IRET can change the 
VM bit. Intel486 Microprocessor gates must be used, 
since 80286 gates save only the low 1 6 bits of the 
FLAGS register, so that the VM bit will not be saved 
on transitions through the 80286 gates. Also, the 
16-bit IRET (presumably) used to terminate the 
80286 interrupt handler will pop only the lower 16 
bits from FLAGS, and will not affect the VM bit. The 
action taken for an Intel486 Microprocessor Trap or 
Interrupt gate if an interrupt occurs while the task is 
executing in virtual 8086 mode is given by the follow- 
ing sequence. 

(1) Save the FLAGS register in a temp to push later. 
Turn off the VM and TF bits, and if the interrupt 
is serviced by an Interrupt Gate, turn off IF also. 

(2) Interrupt and Trap gates must perform a level 
switch from 3 (where the VM86 program exe- 
cutes) to level (so IRET can return). This pro- 
cess involves a stack switch to the stack given 
in the TSS for privilege level 0. Save the Virtual 
8086 Mode SS and ESP registers to push in a 
later step. The segment register load of SS will 
be done as a Protected Mode segment load, 
since the VM bit was turned off above. 
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8086 Application makes "Open File Call" -^ causes 

General Protection Fault (Arrow #1) 

Virtual 8086 Monitor intercepts call. Calls lntel486TM CPU OS (Arrow #2) 

lntel486TM CPU OS opens file returns control to 8086 OS (Arrow #3) 

8086 OS returns control to application. (Arrow #4) 

Transparent to Application 



Figure 4.25. Virtual 8086 Environment Interrupt and Call Handling 



(3) Push the 8086 segment register values onto the 
new stack, in the order: GS, FS, DS, ES. These 
are pushed as 32-bit quantities, with undefined 
values in the upper 16 bits. Then load these 4 
registers with null selectors (0). 

(4) Push the old 8086 stack pointer onto the new 
stack by pushing the SS register (as 32-bits, high 
bits undefined), then pushing the 32-bit ESP reg- 
ister saved above. 

(5) Push the 32-bit FLAGS register saved in step 1 . 

(6) Push the old 8086 instruction pointer onto the 
new stack by pushing the CS register (as 32-bits, 
high bits undefined), then pushing the 32-bit EIP 
register. 

(7) Load up the new CS:EIP value from the interrupt 
gate, and begin execution of the interrupt routine 
in protected Intel486 Microprocessor mode. 

The transition out of virtual 8086 mode performs a 
level change and stack switch, in addition to chang- 



ing back to protected mode. In addition, all of the 
8086 segment register linages are stored on the 
stack (behind the SS:ESP image), and then loaded 
with null (0) selectors before entering the interrupt 
handler. This will permit the handler to safely save 
and restore the DS, ES, FS, and GS registers as 
80286 selectors. This is needed so that interrupt 
handlers which don't care about the mode of the 
interrupted program can use the same prolog and 
epilog code for state saving (i.e., push all registers in 
prolog, pop all in epilog) regardless of whether or not 
a "native" mode or Virtual 8086 mode program was 
interrupted. Restoring null selectors to these regis- 
ters before executing the IRET will not cause a trap 
in the interrupt handler. Interrupt routines which ex- 
pect values in the segment registers, or return val- 
ues in segment registers will have to obtain/return 
values from the 8086 register images pushed onto 
the new stack. They will need to know the mode of 
the interrupted program in order to know where to 
find/return segment registers, and also to know how 
to interpret segment register values. 
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The I RET instruction will perform the inverse of the 
above sequence. Only the extended Intel486 Micro- 
processors IRET instruction (operand size = 32) can 
be used, and must be executed at level to change 
theVMbittoL 

(1) If the NT bit in the FLAGs register is on, an inter- 
task return is performed. The current state is 
stored in the current TSS, and the link field in the 
current TSS is used to locate the TSS for the 
interrupted task which is to be resumed. 

Otherwise, continue with the following se- 
quence. 

(2) Read the FLAGS image from SS:8[ESP] Into the 
FLAGS register. This will set VM to the value 
active in the interrupted routine. 

(3) Pop off the instruction pointer CS:EIP. EIP is 
popped first, then a 32-bit word is popped which 
contains the OS value in the lower 16 bits. If 
VM = 0, this OS load is done as a protected 
mode segment load. If VM = 1, this will be done 
as an 8086 segment load. 



(4) Increment the ESP register by 4 to bypass the 
FLAGS image which was "popped" in step 1. 

(5) If VM = 1, load segment registers ES, DS, FS, 
and GS from memory locations SS:[ESP + 8], 
SS:[ESP-I-12], SS:[ESP+16], and 
SS:[ESP + 20], respectively, where the new val- 
ue of ESP stored in step 4 is used. Since VM = 1 , 
these are done as 8086 segment register loads. 

Else if VM = 0, check that the selectors in ES, 
DS, FS, and GS are valid in the interrupted rou- 
tine. Null out invalid selectors to trap If an at- 
tempt is made to access through them. 

(6) If (RPL(GS) > GPL), pop the stack pointer 
SS:ESP from the stack. The ESP register is 
popped first, followed by 32-bits containing SS in 
the lower 16 bits. If VM = 0, SS Is loaded as a 
protected mode segment register load. If VM = 1 , 
an 8086 segment register load is used. 

(7) Resume execution of the interrupted routine. The 
VM bit in the FLAGS register (restored from the 
interrupt routine's stack image in step 1) deter- 
mines whether the processor resumes the inter- 
rupted routine in Protected mode of Virtual 8086 
mode. 
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5.0 ON-CHIP CACHE 

To meet its performance goals the Intel486 Micro- 
processor contains an eight Kbyte cache. The cache 
is software transparent to maintain binary compati- 
bility with previous generations of the lntel386TM/|n- 
tel486TM Architecture. 

The on-chip cache has been designed for maximum 
flexibility and performance. The cache has several 
operating modes offering flexibility during program 
execution and debugging. Memory areas can be de- 
fined as non-cacheable by software and external 
hardware. Protocols for cache line invalidations and 
replacement are implemented in hardware, easing 
system design. 



5.1 Cache Organization 

The on-chip cache is a unified code and data cache. 
The cache is used for both instruction and data ac- 
cesses and acts on physical addresses. 

The cache organization is 4-way set associative and 
each line is 16 bytes wide. The eight Kbytes of 
cache memory are logically organized as 128 sets, 
each containing four lines. 

The cache memory is physically split into four 
2-Kbyte blocks each containing 128 lines (see Fig- 
ure 5.1). Associated with each 2-Kbyte block are 
128 21 -bit tags. There is a valid bit for each line in 
the cache. Each line in the cache is either valid or 
not valid. There are no provisions for partially valid 
lines. 





21 Bit 
Tag 


- 


— 1 6-Byte Line Size -*- 




1 28 Tags 




2k Bytes 


128 
Sets 
















2k Bytes 










2k Bytes 








2k Bytes 


.3 


LRU ^ 


4 Valid 








E 


nts 


Bits 










T 

128 
Sets 

1 








240440-27 



Figure 5.1. On-Chip Cache Physical Organization 
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The write strategy of on-chip cache is write-through. 
All writes will drive an external write bus cycle in 
addition to writing the information to the internal 
cache if the write was a cache hit. A write to an 
address not contained in the internal cache will only 
be written to external memory. Cache allocations 
are not made on write misses. 



5.2 Cache Control 

Control of the cache is provided by the CD and NW 
bits in CRO. CD enables and disables the cache. NW 
controls memory write-through and invalidates. 

The CD and NW bits define four operating modes of 
the on-chip cache as given in Table 5.1. These 
modes provide flexibility in how the on-chip cache is 
used. 

Table 5.1. Cache Operating Modes 



CD 


NW 


Operating Mode 


1 


1 


Cache fills disabled, write-through and 
invalidates disabled 


1 





Cache fills disabled, write-through and 
invalidates enabled 





1 


INVALID. IF CRO is loaded with this 
configuration of bits, a GP fault with 
error code of is raised. 








Cache fills enabled, write-through and 
invalidates enabled 



CD=1, NW=1 



The cache is completely disabled by setting 
CD=1 and NW=1 and then flushing the 
cache. This mode may be useful for debug- 
ging programs where it is important to see 
all memory cycles at the pins. Writes which 
hit in the cache will not appear on the exter- 
nal bus. 

It Is possible to use the on-chip cache as 
fast static RAM by "pre-loading" certain 
memory areas into the cache and then set- 
ting CD = 1 and NW= 1. Pre-loading can be 
done by careful choice of memory refer- 
ences with the cache turned on or by use of 
the testability functions (see Section 8.2). 
When the cache is turned off the memory 
mapped by the cache is "frozen" into ^he 
cache since fills and invalidates are Dis- 
abled. 



CD=1, NW = 

Cache fills are disabled but write-throughs 
and invalidates are enabled. This mode is 
the same as if the KEN # pin was strapped 
HIGH disabling cache fills. Write-throughs 
and invalidates may still occur to keep the 
cache valid. This mode is useful if the soft- 
ware must disable the cache for a short pe- 
riod of time, and then re-enable it without 
flushing the original contents. 

CD = 0, NW=1 

INVALID. If CRO is loaded with this bit con- 
figuration, a General Protection fault with 
error code of is raised. Note that this 
mode would imply a non-transparent write- 
back cache. A future processor may define 
this combination of bits to implement a 
write-back cache. 

CD = 0, NW = 

This is the normal operating mode. 

Completely disabling the cache is a two step pro- 
cess. First CD and NW must be set to 1 and then the 
cache must be flushed. If the cache is not flushed, 
cache hits on reads will still occur and data will be 
read from the cache. 



5.3 Cache Line Fills 

Any area of memory can be cached in the Intel486 
Microprocessor. Non-cacheable portions of memory 
can be defined by the external system or by soft- 
ware. The external system can inform the Intel486 
Microprocessor that a memory address is non- 
cacheable by returning the KEN# pin inactive during 
a memory access (refer to Section 7.2.3). Software 
can prevent certain pages from being cached by set- 
ting the PCD bit in the page table entry. 

A read request can be generated from program op- 
eration or by an instruction pre-fetch. The data will 
be supplied from the on-chip cache if a cache hit 
occurs on the read address. If the address is not in 
the cache, a read request for the data is generated 
on the external bus. 

If the read request is to a cacheable portion of mem- 
ory, the Intel486 Microprocessor initiates a cache 
line fill. During a line fill a 16-byte line is read into the 
Intel486 Microprocessor. 

Cache fills will only be generated for read misses. 
Write misses will never cause a line in the internal 
cache to be allocated. If a cache hit occurs on a 
write, the line will be updated. 
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Cache line fills can be performed over 8- and 1 6-bit 
busses using the dynamic bus sizing feature. Refer 
to Section 7.1.3 for a description of dynamic bus 
sizing. 

Refer to Section 7.2.3 for further information on 
cacheable cycles. 



5.4 Cache Line Invalidations 

The Intel486 Microprocessor contains both a hard- 
ware and software mechanism for invalidating lines 
in Its internal cache. Cache line invalidations are 
needed to keep the Intel486 Microprocessor's 
cache contents consistent with external memory. 

Refer to Section 7.2.8 for further information on 
cache line invalidations. 



5.5 Cache Replacement 

When a line needs to be placed in its internal cache 
the Intel486 Microprocessor first checks to see if 
there is a non-valid line in the set that can be re- 
placed. If all four lines in the set are valid, a pseudo 
least-recently-used mechanism is used to determine 
which line should be replaced. 

A valid bit is associated with each line in the cache. 
When a line needs to be placed in a set, the four 



valid bits are checked to see if there is a non-valid 
line that can be replaced. If a non-valid line is found, 
that line is marked for replacement. 

The four lines in the set are labeled 10, 11, 12, and 13. 
The order in which the valid bits are checked during 
an invalidation is 10, II, 12 and 13. All valid bits are 
cleared when the processor is reset or when the 
cache is flushed. 

Replacement in the cache is handled by a pseudo 
least recently used (LRU) mechanism when all four 
lines in a set are valid. Three bits, BO, B1 and 82, 
are defined for each of the 128 sets in the cache. 
These bits are called the LRU bits. The LRU bits are 
updated for every hit or replace in the cache. 

If the most recent access to the set was to 10 or II, 
BO is set to 1. BO is set to OJf the most recent ac- 
cess was to 12 or 13. If the most recent access to 
10:11 was to 10, B1 is set to 1, else B1 is set to 0. If 
the most recent access to 12:13 was to 12, B2 is set to 
1 , else B2 is set to 0. 

The pseudo LRU mechanism works in the following 
manner. When a line must be replaced, the cache 
will first select which of 10:11 and 12:13 was least re- 
cently used. Then the cache will determine which of 
the two lines was least recently used and mark it for 
replacement. This decision tree is shown in Figure 
5.2. When the processor is reset or when the cache 
is flushed all 128 sets of three LRU bits are set to 0. 
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Figure 5.2. On-Chip Cache Replacement Strategy 
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5.6 Page Cacheability 

Two bits for cache control, PWT and PCD, are de- 
fined in the page table and page directory entries. 
The state of these bits are driven out on the PWT 
and PCD pins during memory access cycles. 

The PWT bit controls write policy for second level 
caches used with the Intel486 Microprocessor. Set- 
ting PWT=1 defines a write-through policy for the 
current page while PWT = allows the possibility of 
write-back. The state of PWT is ignored internally by 
the Intel486 Microprocessor since the on-chip cache 
is write through. 



The PCD bit controls cacheability on a page by page 
basis. The PCD bit is internally ANDed with the 
KEN# signal to control cacheability on a cycle by 
cycle basis (see Figure 5.3). PCD = enables cach- 
ing while PCD = 1 forbids it. Note that cache fills are 
enabled when PCD = AND KEN# = 0. This logical 
AND is implemented physically with a NOR gate. 

The state of the PCD bit in the page table entry is 
driven on the PCD pin when a page in external mem- 
ory is accessed. The state of the PCD pin informs 
the external system of the cacheability of the re- 
quested information. The external system then re- 
turns KEN# telling the Intel486 Microprocessor if 
the area is cacheable. The Intel486 Microprocessor 
initiates a cache line fill if PCD and KEN# indicate 
that the requested information is cacheable. 
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Figure 5.3. Page Cacheability 
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The PCD bit is masked with the CD (cache disable) 
bit in control register to determine the state of the 
PCD pin. If CD=1 the Intel486 Microprocessor 
forces the PCD pin HIGH. If CD = the PCD pin is 
driven with the value for the page table entry/direc- 
tory. See Figure 5.3. 

The PWT and PCD bits for a bus cycle are obtained 
from either CR3, the page directory or page table 
entry. These bits are assumed to be zero during real 
mode, whenever paging Is disabled, or for cycles 
that bypass paging, (I/O references, interrupt ac- 
knowledge and Halt cycles), the PWT and PCD bits 
are taken from CR3. These bits are initialized to on 
reset, but can be set to any value by level soft- 
ware. 

When paging is enabled, the bits from the page table 
entry are cached in the TLB, and are driven any time 
the page mapped by the TLB entry is referenced. 
For normal memory cycles, PWT and PCD are taken 
from the page table entry. During TLB refresh cycles 
where the page table and directory entries are read, 
the PWT and PCD bits must be obtained elsewhere. 
During page table updates the bits are obtained from 
the page directory. When the page directory is up- 
dated the bits are obtained from CR3. 



5.7 Cache Flushing 

The on-chip cache can be flushed by external hard- 
ware or by software instructions. Flushing the cache 
clears ail valid bits for all lines in the cache. The 
cache is flushed when external hardware asserts the 
FLUSH # pin. 

The flush pin needs to be asserted for one clock if 
driven synchronously or for two clocks if driven 
asynchronously. The flush input is asynchronous but 
setup and hold times must be met The flush pin 
should be deasserted after the cache flush is com- 
plete. Failure to deassert the pin will cause execu- 
tion to stop as the processor will be repeatedly flush- 
ing the cache. If external hardware activates flush in 
response to an I/O write, flush must be asserted for 
at least two clocks prior to ready being returned for 
the I/O write. This ensures that the flush completes 
before the CPU begins execution of the instruction 
following the OUT instruction. 

Flush is recognized during HOLD just like EADS#. 

The instructions INVD and WBINVD cause the on- 
cache to be flushed. External caches connected to 
the Intel486 microprocessor are signalled to flush 
their contents when these instructions are executed. 

WBINVD will cause an external write-back cache to 
write back dirty lines before flushing its contents. 
The external cache is signalled using the bus cycle 
definition pins and the byte enables (refer to Section 



6.2.5 for the bus cycle definition pins and Section 
7.2.11 for special bus cycles). Refer to the Intel486 
Microprocessor programmers reference manual for 
detailed Instruction definitions. 

The results of the INVD and WBINVD instructions 
are Identical for the operation of the Intel486 Micro- 
processor's on-chip cache since the cache is write- 
through. Note that the INVD and WBINVD instruc- 
tions are machine dependent. Future members of 
the Intel486 Microprocessor family may change the 
definition of this instruction. 



5.8 Caching Translation Lookaside 
Buffer Entries 

The Intel486 Microprocessor contains an integrated 
paging unit with a translation lookaside buffer (TLB). 
The TLB contains 32 entries. The TLB has been en- 
hanced over the 386 Microprocessor's TLB by up- 
grading the replacement strategy to a pseudo-LRU 
(least recently used) algorithm. The pseudo-LRU re- 
placement algorithm is the same as that used in the 
on-chip cache. 

The paging TLB operation is automatic whenever 
paging is enabled. The TLB contains the most re- 
cently used page table entries. A page table entry 
translates the linear address pointing to a particular 
page to the physical address where the page is 
stored in memory (refer to Section 4.5, Paging). 

The paging unit will look up the linear address in the 
TLB in response to an internal bus request. The cor- 
responding physical address is passed on to the on- 
chip cache or the external bus (in the event of a 
cache miss) when the linear address is present in 
the TLB. 

The paging unit will access the page tables in exter- 
nal memory if the linear address is not in the TLB. 
The required page table entry will be read into the 
TLB and then the cache or bus cycle for the actual 
data will take place. The process of reading a new 
page table entry into the TLB is called a TLB refresh. 

A TLB refresh is a two step process. The paging unit 
must first read the page directory entry which points 
to the appropriate page table. The page table entry 
to be stored in the TLB is then read from the page 
table. Control register 3 (CR3) points to the base of 
the page directory table. 

The Intel486 Microprocessor will allow page directo- 
ry and page table entries (returned during TLB re- 
freshes) to be stored in the on-chip cache. Setting 
the PCD bits in CR3 and the page directory entry to 
1 will prevent the page directory and page table en- 
tries from being stored in the on-chip cache (see 
Section 5.6, Page Cacheability). 
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6.0 HARDWARE INTERFACE 



6.1 Introduction 

The Intel486 Microprocessor bus has been designed 
to be similar to the 386 Microprocessor bus whenev- 
er possible. Several new features have been added 
to the Intel486 Microprocessor bus resulting in in- 
creased performance and functionality. New fea- 
tures include a 1X clock, a burst bus mechanism for 
high-speed internal cache fills, a cache line invalida- 
tion mechanism, enhanced bus arbitration capabili- 
ties, a BS8# bus sizing mechanism and parity sup- 
port. 

The Intel486 Microprocessor is driven by a 1X clock 
as opposed to a 2X clock in the 386 Microprocessor. 
A 25 MHz Intel486 Microprocessor uses a 25 MHz 
clock in contrast to a 25 MHz 386 Microprocessor 
which requires a 50 MHz clock. A 1X clock allows 
simpler system design by cutting in half the clock 
speed required in the external system. 



Like the 386 Microprocessor, the Intel486 Micro- 
processor has separate parallel busses for data and 
addresses. The bidirectonal data bus is 32 bits in 
width. The address bus consists of two components: 
30 address lines (A2-A31) and 4 byte enable lines 
(BE0#-BE3#). The address bus addresses exter- 
nal memory In the same manner as the 386 Micro- 
processor: The address lines form the upper 30 bits 
of the address and the byte enables select individual 
bytes within a 4 byte location. The address lines are 
bidirectional for use in cache line invalidations. 

The Intel486 Microprocessor's burst bus mechanism 
enables high-speed cache fills from external memo- 
ry. Burst cycles can strobe data into the processor at 
a rate of one item every clock. Non-burst cycles 
have a maximum rate of one item every two clocks. 
Burst cycles are not limited to cache fills: all bus 
cycles requiring more than a single data cycle can 
be bursted. 
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The Intel486 Microprocessor has a bus hold feature 
similar to that of the 386 Microprocessor. During bus 
hold, the Intel486 Microprocessor relinquishes con- 
trol of the local bus by floating its address, data and 
control busses. 

The Intel486 Microprocessor has an address hold 
feature in addition to bus hold. During address hold 
only the address bus is floated, the data and control 
busses can remain active. Address hold is used for 
cache line invalidations. 

Ahead is a brief description of the Intel486 Micro- 
processor input and output signals arranged by func- 
tional groups. Before beginning the signal descrip- 
tions a few terms need to be defined. The # symbol 
at the end of a signal name indicates the active, or 
asserted, state occurs when the signal is at a low 
voltage. When a # is not present after the signal 
name, the signal is active at the high voltage level. 
The term "ready" is used to indicate that the cycle is 
terminated with RDY# or BRDY#. 

Section 6 and 7 will discuss bus cycles and data 
cycles. A bus cycle is at least two clocks long and 
begins with ADS# active in the first clock and ready 
active in the last clock. Data Is transferred to or from 
the Intel486 Microprocessor during a data cycle. A 
bus cycle contains one or more data cycles. 



6.2 Signal Descriptions 

6.2.1 CLOCK (CLK) 

CLK provides the fundamental timing and the inter- 
nal operating frequency for the Intel486 Microproc- 
essor. All external timing parameters are specified 
with respect to the rising edge of CLK. 



The Intel486 Microprocessor can operate over a 
wide frequency range but CLK's frequency cannot 
change rapidly while RESET is inactive. CLK's fre- 
quency must be stable for proper chip operation 
since a single edge of CLK is used internally to gen- 
erate two phases. CLK only needs TTL levels for 
proper operation. Figure 6.2 illustrates the CLK 
waveform. 



6.2.2 ADDRESS BUS (A31-A2, BE0#-BE3#) 

A31-A2 and BE0#-BE3# form the address bus 
and provide physical memory and I/O port address- 
es. The Intel486 Microprocessor is capable of ad- 
dressing 4 gigabytes of physical memory space 
(OOOOOOOOH through FFFFFFFFH), and 64 Kbytes 
of I/O address space (OOOOOOOOH through 
OOOOFFFFH). A31 -A2 identify addresses to a 4-byte 
location. BE0#-BE3# identify which bytes within 
the 4-byte location are involved in the current trans- 
fer. 

Addresses are driven back into the Intel486 Micro- 
processor over A31-A4 during cache line invalida- 
tions. The address lines are active HIGH. When 
used as Inputs into the processor, A31-A4 must 
meet the setup and hold times, t22 and t23. A31 --A2 
are not driven during bus or address hold. 

The byte enable outputs, BE0#-BE3#, determine 
which bytes must be driven valid for read and write 
cycles to external memory. 

BE3# applies to D24-D31 
BE2# applies to D16-D23 
BE1# applies to D8-D15 
BEO# applies to D0-D7 
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Figure 6.2. CLK waveform 
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BE0#-BE3# can be decoded to generate AO, A1 
and BHE# signals used in 8- and 16-bit systems 
(see Table 7.5). BE0#-BE3# are active LOW and 
are not driven during bus hold. 

6.2.3 DATA LINES (D31-D0) 

The bidirectional lines, D31-D0, form the data bus 
for the Intel486 Microprocessor. D0-D7 define the 
least significant byte and D24-D31 the most signifi- 
cant byte. Data transfers to 8- or 16-blt devices is 
possible using the data bus sizing feature controlled 
by the BS8# or BS16# input pins. 

D31-D0 are active HIGH. For reads, D31-D0 must 
meet the setup and hold times, t22 and t23. D31 -DO 
are not driven during read cycles and bus hold. 

6.2.4 PARITY 

Data Parity Input/Outputs (DP0-DP3) 

DP0-DP3 are the data parity pins for the processor. 
There is one pin for each byte of the data bus. Even 
parity is generated or checked by the parity genera- 
tors/checkers. Even parity means that there are an 
even number of HIGH inputs on the eight corre- 
sponding data bus pins and parity pin. 

Data parity is generated on all write data cycles with 
the same timing as the data driven by the Intel486 
Microprocessor. Even parity information must be 
driven back to the Intel486 Microprocessor on these 
pins with the same timing as read information to in- 
sure that the correct parity check status is indicated 
by the Intel486 Microprocessor. 

The values read on these pins do not affect program 
execution. It is the responsibility of the system to 
take appropriate actions if a parity error occurs. 

Input signals on DP0-DP3 must meet setup and 
hold times t22 and t23 for proper operation. 

Parity Status Output (PCHK#) 

Parity status is driven on the PCHK# pin, and a pari- 
ty error is indicated by this pin being LOW. PCHK# 
is driven the clock after ready for read operations to 
indicate the parity status for the data sampled at the 
end of the previous clock. Parity is checked during 
code reads, memory reads and I/O reads. Parity is 
not checked during interrupt acknowledge cycles. 
PCHK# only checks the parity status for enabled 
bytes as indicated by the byte enable and bus size 
signals. It is valid only in the clock immediately after 
read data is returned to the Intel486 microprocessor. 
At all other times it is inactive (HIGH). PGHK# is 
never floated. 



Driving PCHK# is the only effect that bad input pari- 
ty has on the Intel486 Microprocessor. The Intel486 
Microprocessor will not vector to a bus error inter- 
rupt when bad data parity is returned. In systems 
that will not employ parity, PCHK# can be ignored. 
In systems not using parity, DP0-DP3 should be 
connected to Vcc through a pullup resistor. 

6.2.5 BUS CYCLE DEFINITION 
M/IO#, D/C#, W/R# Outputs 

M/IO#, D/C# and W/R# are the primary bus cycle 
definition signals. They are driven valid as the ADS# 
signal is asserted. M/IO# distinguishes between 
memory and I/O cycles, D/C# distinguishes be- 
tween data and control cycles and W/R# distin- 
guishes between write and read cycles. 

Bus cycle definitions as a function of M/IO#, D/C# 
and W/R# are given in Table 6.1. Note there is a 
difference between the Intel486 Microprocessor and 
386 Microprocessor bus cycle definitions. The halt 
bus cycle type has been moved to location 001 in 
the Intel486 Microprocessor from location 101 in the 
386 Microprocessor. Location 101 is now reserved 
and will never be generated by the Intel486 Micro- 
processor. 



Table 6.1 


. ADS# Initiated Bus Cycle Definitions 


M/IO# 


D/C# 


W/R# 


Bus Cycle Initiated 











Interrupt Acknowledge 








1 


Halt/Special Cycle 





1 





I/O Read 





1 


1 


I/O Write 


1 








Code Read 


1 





1 


Reserved 


1 


1 





Memory Read 


1 


1 


1 


Memory Write 



Special bus cycles are discussed in Section 7.2.11. 

Bus Lock Output (LOCK#) 

LOCK# indicates that the Intel486 Microprocessor 
is running a read-modify-write cycle where the exter- 
nal bus must not be relinquished between the read 
and write cycles. Read-modify-write cycles are used 
to implement memory-based semaphores. Multiple 
reads or writes can be locked. 

When LOCK# is asserted, the current bus cycle is 
locked and the Intel486 Microprocessor should be 
allowed exclusive access to the system bus. 
LOCK# goes active in the first clock of the first 
locked bus cycle and goes inactive after ready is 
returned indicating the last locked bus cycle. 
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The Intel486 Microprocessor will not acknowledge 
bus hold when LOCK# is asserted (though it will 
allow an address hold). LOCK# is active LOW and 
is floated during bus hold. Locked read cycles will 
not be transformed into cache fill cycles if KEN# is 
returned active. Refer to Section 7.2.6 for a detailed 
discussion of Locked bus cycles. 

Pseudo-Lock Output (PLOCK#) 

The pseudo-lock feature allows atomic reads and 
writes of memory operands greater than 32 bits. 
These operands require more than one cycle to 
transfer. The Intel486 Microprocessor asserts 
PLOCK# during floating point long reads and writes 
(64 bits), segment table descriptor reads (64 bits) 
and cache line fills (128 bits). 

When PLOCK# is asserted no other master will be 
given control of the bus between cycles. A bus hold 
request (HOLD) is not acknowledged during pseudo- 
locked reads and writes, with one exception. During 
non-cacheable non-bursted code prefetches, HOLD 
is recognized on memory cycle boundaries even 
though PLOCK# is asserted. The Intel486 Micro- 
processor will drive FLOCK # active until the ad- 
dresses for the last bus cycle of the transaction 
have been driven regardless of whether BRDY# or 
RDY# are returned. 

A pseudo-locked transfer is meaningful only if the 
memory operand is aligned and if its completely con- 
tained within a single cache line. A 64-bit floating 
point number must be aligned to an 8-byte boundary 
to guarantee an atomic access. 

Normally PLOCK# and BLAST# are inverse of 
each other. However during the first cycle of a 64-bit 
floating point write, both PLOCK# and BLAST# will 
be asserted. 

Since PLOCK# is a function of the bus size and 
KEN# inputs, PLOCK# should be sampled only in 
the clock ready is returned. This pin is active LOW 
and is not driven during bus hold. Refer to Section 
7.2.7 for a detailed discussion of pseudo-locked bus 
cycles. 

6.2.6 BUS CONTROL 

The bus control signals allow the processor to indi- 
cate when a bus cycle has begun, and allow other 
system hardware to control burst cycles, data bus 
width and bus cycle termination. 

Address Status Output (ADS#) 

The ADS# output indicates that the address and 
bus cycle definition signals are valid. This signal will 



go active In the first clock of a bus cycle and go 
inactive in the second and subsequent clocks of the 
cycle. ADS# is also inactive when the bus is idle. 

ADS# is used by external bus circuitry as the indica- 
tion that the processor has started a bus cycle. The 
external circuit must sample the bus cycle definition 
pins on the next rising edge of the clock after ADS# 
is driven active. 

ADS# is active LOW and is not driven during bus 
hold. 

Non-burst Ready Input (RDY#) 

RDY# indicates that the current bus cycle is com- 
plete. In response to a read, RDY# indicates that 
the external system has presented valid data on the 
data pins. In response to a write request, RDY# indi- 
cates that the external system has accepted the In- 
tel486 microprocessor data. RDY# is ignored when 
the bus is idle and at the end of the first clock of the 
bus cycle. Since RDY# is sampled during address 
hold, data can be returned to the processor when 
AHOLD is active. 

RDY# is active LOW, and is not provided with an 
internal pullup resistor. This input must satisfy setup 
and hold times tie and X^j for proper chip operation. 



6.2.7 BURST CONTROL 
Burst Ready Input (BRDY#) 

BRDY# performs the same function during a burst 
cycle that RDY# performs during a non-burst cycle. 
BRDY# indicates that the external system has pre- 
sented valid data on the data pins in response to a 
read or that the external system has accepted the 
Intel486 Microprocessor data in response to a write. 
BRDY# is ignored when the bus is idle and at the 
end of the first clock in a bus cycle. 

During a burst cycle, BRDY# will be sampled each 
clock, and if active, the data presented on the data 
bus pins will be strobed into the Intel486 Microproc- 
essor. ADS# is negated during the second through 
last data cycles in the burst, but address lines A2- 
A3 and byte enables will change to reflect the next 
data item expected by the Intel486 Microprocessor. 

If RDY# is returned simultaneously with BRDY#, 
BRDY# is ignored and the burst cycle is premature- 
ly aborted. An additional complete bus cycle will be 
initiated after an aborted burst cycle if the cache line 
fill was not complete. BRDY# is treated as a normal 
ready for the last data cycle in a burst transfer or for 
non-burstable cycles. Refer to Section 7.2.2 for 
burst cycle timing. 
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BRDY# is active LOW and is provided with a small 
internal pullup resistor. BRDY# must satisfy the set- 
up and hold times t-ie and tiy. 

Burst Last Output (BLAST#) 

BLAST# indicates that the next time BRDY# is re- 
turned it will be treated as a normal RDY#, terminat- 
ing the line fill or other multiple-data-cycle transfer. 
BLAST# is active for all bus cycles regardless of 
whether they are cacheable or not. This pin is active 
LOW and is not driven during bus hold. 



6.2.8 INTERRUPT SIGNALS (RESET, INTR, 
NMI) 

The interrupt signals can interrupt or suspend exe- 
cution of the processor's current instruction stream. 

Reset Input (RESET) 

RESET forces the Intel486 Microprocessor to begin 
execution at a known state. For a power-up (cold 
start) reset, Vcc and CLK must reach their proper 
DC and AC specifications for at least 1 ms before 
the Intel486 Microprocessor begins instruction exe- 
cution. The RESET pin should remain active during 
this time to ensure proper Intel486 Microprocessor 
operation. However, for a warm boot-up case, 
RESET is required to remain active for a minimum of 
1 5 clocks. The testability operating modes are pro- 
grammed by the falling (inactive going) edge of 
RESET. (Refer to Section 8.0 for a description of the 
test modes during reset.) 

Maskable Interrupt Request Input (INTR) 

INTR indicates that an external interrupt has been 
generated. Interrupt processing is Initiated if the IF 
flag is active In the EFLAGS register. 

The Intel486 Microprocessor will generate two 
locked interrupt acknowledge bus cycles in re- 
sponse to asserting the INTR pin. An 8-bit interrupt 
number will be latched from an external interrupt 
controller at the end of the second interrupt ac- 
knowledge cycle. INTR must remain active until the 
interrupt acknowledges have been performed to as- 
sure program interruption. Refer to Section 7.2.10 
for a detailed discussion of interrupt acknowledge 
cycles. 

The INTR pin is active HIGH and is not provided with 
an internal pulldown resistor. INTR is asynchronous, 
but the INTR setup and hold times, tao and t2i, must 
be met to assure recognition on any specific clock. 

Non-maskable Interrupt Request Input (NMI) 

NMI is the non-maskable interrupt request signal. 
Asserting NMI causes an interrupt with an internally 



supplied vector value of 2. External interrupt ac- 
knowledge cycles are not generated since the NMI 
interrupt vector is internally generated. When NMI 
processing begins, the NMI signal will be masked 
internally until the IRET instruction is executed. 

NMI is rising edge sensitive after internal synchroni- 
zation. NMI must be held LOW for at least four CLK 
periods before this rising edge for proper operation. 
NMI is not provided with an internal pulldown resis- 
tor. NMI is asynchronous but setup and hold times, 
t2o and t2i must be met to assure recognition on any 
specific clock. 

6.2.9 BUS ARBITRATION SIGNALS 

This section describes the mechanism by which the 
processor relinquishes control of its local bus when 
requested by another bus master. 

Bus Request Output (BREQ) 

The Intel486 Microprocessor asserts BREQ when- 
ever a bus cycle is pending internally. Thus, BREQ is 
always asserted in the first clock of a bus cycle, 
along with ADS#. Furthermore, if the Intel486 Mi- 
croprocessor is currently not driving the bus (due to 
HOLD, AHOLD, or BOFF#). BREQ is asserted in 
the same clock that ADS# would have been assert- 
ed if the processor were driving the bus. After the 
first clock of the bus cycle, BREQ may change state. 
It will be asserted if additional cycles are necessary 
to complete a transfer (via BS8#, BS16#, KEN#), 
or if more cycles are pending internally. However, if 
no additional cycles are necessary to complete the 
current transfer, BREQ can be negated before ready 
comes back for the current cycle. External logic can 
use the BREQ signal to arbitrate among multiple 
processors. This pin is driven regardless of the state 
of bus hold or address hold. BREQ is active HIGH 
and is never floated. During a hold state, internal 
events may cause BREQ to be deasserted prior to 
any bus cycles. 

Bus Hold Request Input (HOLD) 

HOLD allows another bus master complete control 
of the Intel486 Microprocessor bus. The Intel486 Mi- 
croprocessor will respond to an active HOLD signal 
by asserting HLDA and placing most of its output 
and input/output pins in a high impedance state 
(floated) after completing its current bus cycle, burst 
cycle, or sequence of locked cycles. In addition, if 
the Intel486 CPU receives a HOLD request while 
performing a non-cacheable, non-bursted code pre- 
fetch and that cycle is backed off (BOFF#), the In- 
tel486 CPU will recognize HOLD before restarting 
the cycle. The BREQ, HLDA, PCHK# and FERR# 
pins are not floated during bus hold. The Intel486 



89 



intel. 



lntel486TM dX MICROPROCESSOR 



IPI^iLOIlDKl^l^Y 



Microprocessor will maintain its bus in this state until 
the HOLD is deasserted. Refer to Section 7.2.9 for 
timing diagrams for a bus hold cycle. 

Unlike the 386 Microprocessor, the Intel486 Micro- 
processor will recognize HOLD during reset. Pullup 
resistors are not provided for the outputs that are 
floated in response to HOLD. HOLD is active HIGH 
and is not provided with an internal pulldown resis- 
tor. HOLD must satisfy setup and hold times t-is and 
ti9 for proper chip operation. 

Bus Hold Acknowledge Output (HLDA) 

HLDA indicates that the Intel486 Microprocessor 
has given the bus to another local bus master. HLDA 
goes active in response to a hold request presented 
on the HOLD pin. HLDA is driven active in the same 
clock that the Intel486 Microprocessor floats its bus. 

HLDA will be driven inactive when leaving bus hold 
and the Intel486 Microprocessor will resume driving 
the bus. The Intel486 Microprocessor will not cease 
internal activity during bus hold since the internal 
cache will satisfy the majority of bus requests. HLDA 
is active HIGH and remains driven during bus hold. 

Backoff Input (BOFF#) 

Asserting the BOFF# input forces the Intel486 Mi- 
croprocessor to release control of its bus in the next 
clock. The pins floated are exactly the same as in 
response to HOLD. The response to BOFF# differs 
from the response to HOLD In two ways: First, the 
bus is floated immediately in response to BOFF# 
while the Intel486 Microprocessor completes the 
current bus cycle before floating its bus in response 
to HOLD. Second the Intel486 does not assert 
HLDA in response to BOFF#. 

The processor remains In bus hold until BOFF# is 
negated. Upon negation, the Intel486 Microproces- 
sor restarts the bus cycle aborted when BOFF# was 
asserted. To the internal execution engine the effect 
of BOFF# is the same as inserting a few wait states 
to the original cycle. Refer to Section 7.2.12 for a 
description of bus cycle restart. 

Any data returned to the processor while BOFF# is 
asserted is ignored. BOFF# has higher priority than 
RDY# or BRDY#. If both BOFF# and ready are 
returned in the same clock, BOFF# takes effect. If 
BOFF# is asserted while the bus is idle, the Intel486 
Microprocessor will float its bus in the next clock. 
BOFF# is active LOW and must meet setup and 
hold times t-js and tig for proper chip operation. 



tel486 Microprocessors address lines, A4-A31, to 
accept an address input. EADS# indicates that an 
external address Is actually valid on the address in- 
puts. Activating EADS# will cause the Intel486 Mi- 
croprocessor to read the external address bus and 
perform an internal cache invalidation cycle to the 
address indicated. Refer to Section 7.2.8 for cache 
Invalidation cycle timing. 

Address Hold Request Input (AHOLD) 

AHOLD is the address hold request. It allows anoth- 
er bus master access to the Intel486 Microproces- 
sor address bus for performing an internal cache in- 
validation cycle. Asserting AHOLD will force the 
Intel486 Microprocessor to stop driving its address 
bus In the next clock. While AHOLD is active only 
the address bus will be floated, the remainder of the 
bus can remain active. For example, data can be 
returned for a previously specified bus cycle when 
AHOLD is active. The Intel486 Microprocessor will 
not initiate another bus cycle during address hold. 
Since the Intel486 Microprocessor floats its bus im- 
mediately In response to AHOLD, an address hold 
acknowledge is not required. If AHOLD is asserted 
while a bus cycle is in progress, and no readies are 
returned during the time AHOLD is asserted, the In- 
tel486 will redrive the same address (that it originally 
sent out) once AHOLD is negated. 

AHOLD Is recognized during reset. Since the entire 
cache is invalidated by reset, any invalidation cycles 
run during reset will be unnecessary. AHOLD is ac- 
tive HIGH and Is provided with a small Internal pull- 
down resistor. It must satisfy the setup and hold 
times ti8 and tig for proper chip operation. This pin 
determines whether or not the built in self test fea- 
tures of the Intel486 Microprocessor will be exer- 
cised on assertion of RESET. 

External Address Valid Input (EADS#) 

EADS# indicates that a valid external address has 
been driven onto the Intel486 address pins. This ad- 
dress will be used to perform an internal cache inval- 
idation cycle. The external address will be checked 
with the current cache contents. If the address spec- 
ified matches any areas in the cache, that area will 
immediately be invalidated. 

An invalidation cycle may be run by asserting 
EADS# regardless of the state of AHOLD, HOLD 
and BOFF#. EADS# is active LOW and is provided 
with an internal pullup resistor. EADS# must satisfy 
the setup and hold times ti2 and ti3 for proper chip 
operation. 



6.2.10 CACHE INVALIDATION 

The AHOLD and EADS# inputs are used during 
cache Invalidation cycles. AHOLD conditions the In- 
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6.2.11 CACHE CONTROL 
Cache Enable Input (KEN#) 

KEN# is the cache enable pin. KEN# is used to 
determine whether the data being returned by the 
current cycle is cacheable. When KEN# is active 
and the Intel486 Microprocessor generates a cycle 
that can be cached (most any memory read cycle), 
the cycle will be transformed into a cache line fill 
cycle. 

A cache line is 16 bytes long. During the first cycle of 
a cache line fill the byte-enable pins should be ig- 
nored and data should be returned as if all four byte 
enables were asserted. The Intel486 Microproces- 
sor will run between 4 and 16 contiguous bus cycles 
to fill the line depending on the bus data width se- 
lected by BS8# and BS16#. Refer to Section 7.2.3 
for a description of cache line fill cycles. 

The KEN# input is active LOW and is provided with 
a small internal pullup resistor. It must satisfy the 
setup and hold times ti4 and ti5 for proper chip op- 
eration. 

Cache Flush Input (FLUSH #) 

The FLUSH # input forces the Intel486 Microproces- 
sor to flush its entire internal cache. FLUSH # is ac- 
tive LOW and need only be asserted for one clock. 
FLUSH # is asynchronous but setup and hold times 
t2o and t2i must be met for recognition on any spe- 
cific clock. 

FLUSH # also determines whether or not the tristate 
test mode of the Intel486 Microprocessor will be in- 
voked on assertion of RESET. 



6.2.12 PAGE CACHEABILITY (PWT, PCD) 

The PWT and PCD output signals correspond to two 
user attribute bits in the page table entry. When pag- 
ing is enabled, PWT and PCD correspond to bits 3 
and 4 of the page table entry respectively. For cy- 
cles that are not paged when paging is enabled (for 
example I/O cycles) PWT and PCD correspond to 
bits 3 and 4 in control register 3. When paging is 
disabled, the Intel486 CPU ignores the PCD and 
PWT bits and assumes they are zero for the purpose 
of caching and driving PCD and PWT. 

PCD is masked by the CD (cache disable) bit in con- 
trol register (CRO). When CD = 1 (cache line fills 
disabled) the Intel486 Microprocessor forces PCD 
HIGH. When CD = 0, PCD is driven with the value of 
the page table entry/directory. 

The purpose of PCD is to provide a cacheable/non- 
cacheable indication on a page by page basis. The 



Intel486 will not perform a cache fill to any page in 
which bit 4 of the page table entry is set. PWT corre- 
sponds to the write-back bit and can be used by an 
external cache to provide this functionality. PCD and 
PWT bits are assigned to be zero during real mode 
or whenever paging is disabled. Refer to Sections 
4.5.4 and 5.6 for a discussion of non-cacheable 
pages. 

PCD and PWT have the same timing as the cycle 
definition pins (M/IO#, D/C#, W/R#). PCD and 
PWT are active HIGH and are not driven during bus 
hold. 

6.2.13 NUMERIC ERROR REPORTING 
(FERR#, IGNNE#) 

To allow PC-type floating point error reporting, the 
Intel486 Microprocessor provides two pins, FERR# 
and IGNNE#. 

Floating Point Error Output (FERR#) 

The Intel486 Microprocessor asserts FERR# when- 
ever an unmasked floating point error is encoun- 
tered. FERR# is similar to the ERROR # pin on the 
387 Math Coprocessor. FERR# can be used by ex- 
ternal logic for PC-type floating point error reporting 
in Intel486 Microprocessor systems. FERR# is ac- 
tive LOW, and is not floated during bus hold. 

In some cases, FERR# is asserted when the next 
floating point instruction is encountered and in other 
cases it is asserted before the next floating point 
instruction is encountered depending upon the exe- 
cution state of the instruction causing the exception. 

The following class of floating point exceptions drive 
FERR# at the time the exception occurs (i.e., before 
encountering the next floating point instruction). 

1. The stack fault, invalid operation, and denormal 
exceptions on all transcendental instructions, in- 
teger arithmetic instructions, FSQRT, FSCALE, 
FPREM(1), EXTRACT, FBLD, and FBSTP. 

2. Any exceptions on store instructions (including 
integer store instructions). 

The following class of floating point exceptions drive 
FERR# only after encountering the next floating 
point instruction. 

1. Exceptions other than on all transcendental in- 
structions, integer arithmetic instructions, 
FSQRT, FSCALE, FPREM(1), EXTRACT, FBLD, 
and FBSTP. 

2. Any exception on all basic arithmetic, load, com- 
pare, and control instructions (i.e., all other in- 
structions). 
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Ignore Numeric Error Input (IGNNE#) 

The Intel486 Microprocessor will ignore a numeric 
error and continue executing non-control floating 
point Instructions when IGNNE# is asserted, but 
FERR# will still be activated. When deasserted, the 
Intel486 Microprocessor will freeze on a non-control 
floating point instruction if a previous instruction 
caused an error. IGNNE# has no effect when the 
NE bit in control register is set. 

The IGNNE# input is active LOW and is provided 
with a small internal pullup resistor. This input is 
asynchronous, but must meet setup and hold times 
t2o and t2i to insure recognition on any specific 
clock. 

6.2.14 BUS SIZE CONTROL (BS16#, BS8#) 

The BS16# and BS8# inputs allow external 16- and 
8-bit busses to be supported with a small number of 
external components. The Intel486 CPU samples 
these pins every clock. The value sampled in the 
clock before ready determines the bus size. When 
asserting BS16# or BS8# only 16 or 8 bits of the 
data bus need be valid. If both BS16# and BS8# 
are asserted, an 8-bit bus width is selected. 

When BS16# or BS8# are asserted the Intel486 
Microprocessor will convert a larger data request to 
the appropriate number of smaller transfers. The 
byte enables will also be modified appropriately for 
the bus size selected. 

BS16# and BS8# are active LOW and are provided 
with small internal pullup resistors. BS16# and 
BS8# must satisfy the setup and hold times ti4 and 
ti5 for proper chip operation. 

6.2.15 ADDRESS BIT 20 MASK (A20M#) 

Asserting the A20M# input causes the Intel486 Mi- 
croprocessor to mask physical address bit 20 before 
performing a lookup in the internal cache and before 
driving a memory cycle to the outside world. When 
A20M# is asserted, the Intel486 Microprocessor 
emulates the 1 Mbyte address wraparound that oc- 
curs on the 8086. A20M# is active LOW and must 
be asserted only when the processor is in real 
mode. The A20M# is not defined in Protected 
Mode. A20M# is asynchronous but should meet 
setup and hold times t2o and t2i for recognition in 
any specific clock. For correct operation of the chip, 
A20M# should be sampled high 2 clocks before and 
2 clocks after RESET goes low. When A20M# is 
asserted synchronously, A20M# should be high 
(non-active) at the clock prior to the falling edge of 
RESET. A20M# exhibits a minimum 4 clock latency, 
from time of assertion to masking of the A20 bit. 
A20M# is ignored during cache invalidation cycles. 
I/O writes require A20M# to be asserted a minimum 



of 2 clocks prior to RDY being returned for the I/O 
write. This insures recognition of the address mask 
before the i486 SX Microprocessor/ Intel OverDrive 
Processor begins execution of the instruction follow- 
ing OUT. If A20M# is asserted after the ADS# of a 
data cycle, the A20 address signal is not masked 
during this cycle but is masked in the next cycle. 
During a prefetch (cacheable or not), if A20M# is 
asserted after the first ADS#, A20 is not masked for 
the duration of the prefetch; even if BS16# or BS8# 
Is asserted. 

6.2.16 BOUNDARY SCAN TEST SIGNALS 

The following boundary scan test signals are only 
available on the 50 MHz version of the Intel486 
CPU. 



Test Clock (TCK) 

TCK is an input to the Intel486 CPU and provides 
the clocking function required by the JTAG boundary 
scan feature. TCK is used to clock state information 
and data into and out of the component. State select 
information and data are clocked into the compo- 
nent on the rising edge of TCK on TMS and TDI, 
respectively. Data is clocked out of the part on the 
falling edge of TCK on TDO. 

In addition to using TCK as a free running clock, it 
may be stopped in a low, O, state, indefinitely as 
described in IEEE 1149.1. While TCK is stopped in 
the low state, the boundary scan latches retain their 
state. 

When boundary scan is not used, TCK should be 
tied high or left as a NC (This is important during 
power up to avoid the possibility of glitches on the 
TCK which could prematurely initiate boundary scan 
operations). TCK is supplied with an internal pullup 
resistor. 

TCK is a clock signal and is used as a reference for 
sampling other JTAG signals. On the rising edge of 
TCK, TMS and TDI are sampled. On the falling edge 
of TCK, TDO is driven. 

Test Mode Select (TMS) 

TMS is decoded by the JTAG TAP (Tap Access 
Port) to select the operation of the test logic, as de- 
scribed in Section 8.5.4. 

To guarantee deterministic behavior of the TAP con- 
troller, TMS is provided with an internal pull-up resis- 
tor. If boundary scan is not used, TMS may be tied 
high or left unconnected. TMS is sampled on the 
rising edge of TCK. TMS is used to select the inter- 
nal TAP states required to load boundary scan in- 
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structions to data on TDI. For proper initialization of 
the JTAG logic, TMS should be driven high, "1", for 
at least four TCK cycles following the rising edge of 
RESET. 



Test Data Input (TDI) 

TDI is the serial input used to shift JTAG instructions 
and data into the component. The shifting of instruc- 
tions and data occurs during the SHIFT-IR and 
SHIFT-DR controller states, respectively. These 
states are selected using the TMS signal as de- 
scribed in Section 8.5.4. 

An internal pull-up resistor is provided on TDI to en- 
sure a known logic state if an open circuit occurs on 
the TDI path. Note that when "1" is continuously 
shifted into the instruction register, the BYPASS 
instruction is selected. TDI is sampled on the 
rising edge of TCK, during the SHIFT-IR and the 
SHIFT-DR states. During all other TAP controller 
states, TDI is a "don't care". 

Test Data Output (TDO) 

TDO is the serial output used to shift JTAG instruc- 
tions and data out of the component. The shifting of 
instructions and data occurs during the SHIFT-IR 
and SHIFT-DR TAP controller states, respectively. 
These states are selected using the TMS signal as 
described in Section 8.5.4. When not in SHIFT-IR or 
SHIFT-DR state, TDO is driven to a high impedance 
state to allow connecting TDO of different devices in 
parallel. 

TDO is driven on the falling edge of TCK during the 
SHIFT-IR and SHIFT-DR TAP controller states. At 
all other times TDO is driven to the high impedance 
state. 



6.3 Write Buffers 

The Intel486 Microprocessor contains four write 
buffers to enhance the performance of consecutive 
writes to memory. The buffers can be filled at a rate 
of one write per clock until all four buffers are filled. 

When all four buffers are empty and the bus is Idle, a 
write request will propagate directly to the external 
bus bypassing the write buffers. If the bus Is not 
available at the time the write is generated Internally, 
the write will be placed in the write buffers and prop- 
agate to the bus as soon as the bus becomes avail- 
able. The write is stored in the on-chip cache imme- 
diately If the write is a cache hit. 

Writes will be driven onto the external bus in the 
same order in which they are received by the write 
buffers. Under certain conditions a memory read will 



go onto the external bus before the memory writes 
pending in the buffer even though the writes oc- 
curred earlier in the program execution. 

A memory read will only be reordered In front of all 
writes In the buffers under the following conditions: If 
all writes pending in the buffers are cache hits and 
the read is a cache miss. Under these conditions the 
Intel486 Microprocessor will not read from an exter- 
nal memory location that needs to be updated by 
one of the pending writes. 

Reordering of a read with the writes pending in the 
buffers can only occur once before all the buffers 
are emptied. Reordering read once only maintains 
cache consistency. Consider the following example: 

The CPU writes to location X. Location X is in the 
internal cache, so it is updated there immediately. 
However, the bus is busy so the write out to main 
memory is buffered (see Figure 6.3(a)). At this point, 
any reads to location X would be cache hits and 
most up-to-date data would be read. 
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Figure 6.3(a) 

The next Instruction causes a read to location Y. 
Location Y Is not in the cache (a cache miss). Since 
the write in the write buffer is a cache hit, the read is 
reordered. When location Y is read, it is put into the 
cache. The possibility exists that location Y will re- 
place location X in the cache. If this is true, location 
X would no longer be cached (see Figure 6.3(b)). 
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Figure 6.3(b) 

Cache consistency has been maintained up to this 
point. If a subsequent read is to location X (now a 
cache miss) and it was reordered in front of the buff- 
ered write to location X, stale data would be read. 
This is why only 1 read is allowed to be reordered. 
Once a read is reordered, all the writes in the write 
buffer are flagged as cache misses to ensure that no 
more reads are reordered. Since one of the condi- 
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tions to reorder a read is that all writes in the write 
buffer must be cache hits, no more reordering is al- 
lowed until all of those flagged writes propogate to 
the bus. Similarly, if an invalidation cycle Is run all 
entries in the write buffer are flagged as cache miss- 
es. 

For multiple processor systems and/or systems us- 
ing DMA techniques, such as bus snooping, locked 
semaphores should be used to maintain cache con- 
sistency. 

6.3.1 WRITE BUFFERS AND I/O CYCLES 

Input/Output (I/O) cycles must be handled in a dif- 
ferent manner by the write buffers. 

I/O reads are never reordered in front of buffered 
memory writes. This Insures that the Intel486 Micro- 
processor will update all memory locations before 
reading status from an I/O device. 

The Intel486 Microprocessor never buffers single 
I/O writes. When processing an OUT instruction, in- 
ternal execution stops until the I/O write actually 
completes on the external bus. This allows time for 
the external system to drive an invalidate into the 
Intel486 Microprocessor or to mask interrupts before 
the processor progresses to the instruction following 
OUT. REP OUTS instructions will be buffered. 

I/O device recovery time must be handled slightly 
differently by the Intel486 Microprocessor than with 
the 386 Microprocessor. I/O device back-to-back 
write recovery times could be guaranteed by the 386 
Microprocessor by inserting a jump to the next in- 
struction in the code that writes to the device. The 
jump forces the 386 Microprocessor to generate a 
prefetch bus cycle which can't begin until the I/O 
write completes. 

Inserting a jump to the next write will not work with 
the Intel486 Microprocessor because the prefetch 
could be satisfied by the on-chip cache. A read cycle 
must be explicitly generated to a non-cacheable lo- 
cation in memory to guarantee that a read bus cycle 
is performed. This read will not be allowed to pro- 
ceed to the bus until after the I/O write has complet- 
ed because I/O writes are not buffered. The I/O de- 
vice will have time to recover to accept another write 
during the read cycle. 

6.3.2 WRITE BUFFERS IMPLICATIONS ON 
LOCKED BUS CYCLES 

Locked bus cycles are used for read-modify-write 
accesses to memory. During a read-modify-write ac- 
cess, a memory base variable is read, modified and 
then written back to the same memory location. It is 
important that no other bus cycles, generated by 



other bus masters or by the Intel486 Microprocessor 
itself, be allowed on the external bus between the 
read and write portion of the locked sequence. 

During a locked read cycle the Intel486 Microproc- 
essor will always access external memory, it will 
never look for the location in the on-chip cache, but 
for write cycles, data is written in the internal cache 
(if cache hit) and in the external memory. All data 
pending in the Intel486 Microprocessor's write buff- 
ers will be written to memory before a locked cycle is 
allowed to proceed to the external bus. 

The Intel486 Microprocessor will assert the LOCK# 
pin after the write buffers are emptied during a 
locked bus cycle. With the LOCK# pin asserted, the 
microprocessor will read the data, operate on the 
data and place the results in a write buffer. The con- 
tents of the write buffer will then be written to exter- 
nal memory. LOCK# will become inactive after the 
write part of the locked cycle. 

6.4 Interrupt and Non-Maskable 
Interrupt Interface 

The Intel486 Microprocessor provides two asyn- 
chronous interrupt inputs, INTR (interrupt request) 
and NMI (non-maskable interrupt input). This section 
describes the hardware Interface between the in- 
struction execution unit and the pins. For a descrip- 
tion of the algorithmic response to interrupts refer to 
Section 2.7. For interrupt timings refer to Section 
7.2.10. 

6.4.1 INTERRUPT LOGIC 

The Intel486 Microprocessor contains a two-clock 
synchronizer on the interrupt line. An interrupt re- 
quest will reach the Internal instruction execution 
unit two clocks after the INTR pin is asserted, if 
proper setup is provided to the first stage of the syn- 
chronizer. 

There is no special logic in the interrupt path other 
than the synchronizer. The INTR signal is level sen- 
sitive and must remain active for the instruction exe- 
cution unit to recognize it. The interrupt will not be 
serviced by the Intel486 Microprocessor if the INTR 
signal does not remain active. 

The Instruction execution unit will look at the state of 
the synchronized interrupt signal at specific clocks 
during the execution of instructions (if interrupts are 
enabled). These specific clocks are at instruction 
boundaries, or iteration boundaries in the case of 
string move instructions. Interrupts will only be ac- 
cepted at these boundaries. 

An interrupt must be presented to the Intel486 Mi- 
croprocessor INTR pin three clocks before the end 
of an instruction for the interrupt to be acknowl- 
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edged. Presenting the interrupt 3 clocks before the 
end of an instruction allows the interrupt to pass 
through the two clock synchronizer leaving one 
clock to prevent the initiation of the next sequential 
instruction and to begin interrupt service. If the inter- 
rupt is not received in time to prevent the next in- 
struction, it will be accepted at the end of next in- 
struction, assuming INTR is still held active. The in- 
terrupt service microcode will start after two dead 
clocks. 

The longest latency between when an interrupt re- 
quest is presented on the INTR pin and when the 
interrupt service begins is: longest instruction used 
+ the two clocks for synchronization + one clock 
required to vector into the interrupt service micro- 
code. 



6.4.2 NMI LOGIC 

The NMI pin has a synchronizer like that used on the 
INTR line. Other than the synchronizer, the NMI log- 
ic is different from that of the maskable interrupt. 

NMI is edge triggered as opposed to the level trig- 
gered INTR signal. The rising edge of the NMI signal 
is used to generate the interrupt request. The NMI 
input need not remain active until the interrupt Is ac- 
tually serviced. The NMI pin only needs to remain 
active for a single clock if the required setup and 
hold times are met. NMI will operate properly if it is 
held active for an arbitrary number of clocks. 

The NMI input must be held inactive for at least four 
clocks after it is asserted to reset the edge triggered 
logic. A subsequent NMI may not be generated if the 
NMI is not held inactive for at least two clocks after 
being asserted. 

The NMI input is internally masked whenever the 
NMI routine is entered. The NMI input will remain 
masked until an IRET (return from interrupt) instruc- 
tion is executed. Masking the NMI signal prevents 
recursive NMI calls. If another NMI occurs while the 
NMI is masked off, the pending NMI will be executed 
after the current NMI is done. Only one NMI can be 
pending while NMI is masked. 



6.5 Reset and Initialization 

The Intel486 Microprocessor has a built in self test 
(BIST) that can be run during reset. The BIST is In- 
voked if the AHOLD pin is asserted in the clock prior 
to RESET going from High to Low. RESET must be 
active for 15 clocks with or with no BIST being en- 
abled. Refer to Section 8.0 for information on In- 
tel486 Microprocessor testability. 



The Intel486 Microprocessor registers have the val- 
ues shown in Table 6.2 after RESET is performed. 
The EAX register contains information on the suc- 
cess or failure of the BIST if the self test is executed. 
The DX register always contains a component Iden- 
tifier at the conclusion of RESET. The upper byte of 
DX (DH) will contain 04 and the lower byte (DL) will 
contain a stepping identifier (see Table 6-3). The 
floating point registers are initialized as if the FINIT/ 
FN I NIT (initialize processor) instruction was execut- 
ed if the BIST was performed. If the BIST is not exe- 
cuted, the floating point registers are unchanged. 

Table 6.2. Register Values after Reset 



Register 


Initial Value 
(BIST) 


Initial Value 
(No Bist) 


EAX 


Zero (Pass) 


Undefined 


ECX 


Undefined 


Undefined 


EDX 


0400 + Revision ID 


0400 + Revision ID 


EBX 


Undefined 


Undefined 


ESP 


Undefined 


Undefined 


EBP 


Undefined 


Undefined 


ESI 


Undefined 


Undefined 


EDI 


Undefined 


Undefined 


EFLAGS 


00000002h 


00000002h 


EIP 


OFFFOh 


OFFFOh 


ES 


OOOOh 


OOOOh 


CS 


FOOOh* 


FOOOh* 


SS 


OOOOh 


OOOOh 


DS 


OOOOh 


OOOOh ^ 


FS 


OOOOh 


OOOOh 


GS 


OOOOh 


OOOOh 


IDTR 


Base = 0, Limit =3FFh 


Base = 0, Limit =3FFh 


CRO 


6000001 Oh 


6000001 Oh 


DR7 


OOOOOOOOh 


OOOOOOOOh 


GW 


037Fh 


Unchanged 


SW 


OOOOh 


Unchanged 


TW 


hf-FFh 


Unchanged 


FIP 


OOOOOOOOh 


Unchanged 


FEA 


OOOOOOOOh 


Unchanged 


FCS 


OOOOh 


Unchanged 


FDS 


OOOOh 


Unchanged 


FOP 


OOOh 


Unchanged 


FSTACK 


Undefined 


Unchanged 



95 



inlet. 



lntel486TM dX MICROPROCESSOR 



Pl^iLDMOMMY 



Table 6-3. lntel486TM CPU Revision ID 



lntel486TM CPU 
Stepping Name 


Component 
ID 


Revision 
ID 


B3 


04 


01 


B4 


04 


01 


B5 


04 


01 


B6 


04 


01 


CO 


04 


02 


C1 


04 


03 


DO 


04 


04 


cA2 


04 


10 


cA3 


04 


10 


cBO 


04 


11 


cB1 


04 


11 


Intel OverDriveTM 

Processor 
Stepping Name 


A2 


04 


32 


B1 


04 


33 



The Intel486 Microprocessor will start executing in- 
structions at location FFFFFFFOH after RESET. 
When the first InterSegment Jump or Call is execut- 
ed, address lines A20-A31 will drop LOW for CS-rel- 
ative memory cycles, and the Intel486 Microproces- 
sor will only execute instructions in the lower one 
Mbyte of physical memory. This allows the system 
designer to use a ROM at the top of physical memo- 
ry to initialize the system and take care of RESETS. 

RESET forces the Intel486 Microprocessor to termi- 
nate all execution and local bus activity. No instruc- 
tion or bus activity will occur as long as RESET is 
active. 

All entries in the cache are invalidated by RESET. 



6.5.1 PIN STATE DURING RESET 

The Intel486 Microprocessor recognizes and can re- 
spond to HOLD, AHOLD, and BOFF# requests re- 
gardless of the state of RESET. Thus, even though 
the processor is in reset, it can still float its bus in 
response to any of these requests. 

While in reset, the Intel486 Microprocessor bus is in 
the state shown in Figure 6.4 if the HOLD, AHOLD 
and BOFF# requests are inactive. Note that the ad- 
dress (A31-A2, BE3#-BE0#) and cycle definition 
(M/IO#, D/C#, W/R#) pins are undefined from the 
time reset is asserted up to the start of the first bus 
cycle. All undefined pins (except FERR#) assume 
known values at the beginning of the first bus cycle. 
The first bus cycle is always a code fetch to address 
FFFFFFFOH. 

FERR# reflects the state of the ES (Error Summary 
status) bit in the floating point unit status word. The 
ES bit is initialized whenever the floating point unit 
state is initialized. The floating point unit's status 
word register can be initialized by BIST or by execut- 
ing FIN IT/ FN I NIT instruction. Thus, after reset and 
before executing the first FINIT or FNINIT instructon, 
the values of the FERR# and the numeric status 
word register bits 0-7 depends on whether or not 
BIST is performed. Table 6-4 shows the state of 
FERR# signal after reset and before the execution 
of the FINIT/FNINIT instruction. 

Table 6-4 



BIST 
Performed 


FERR# 
Pin 


FPU Status 

Word Register 

Bits 0-7 


YES 
NO 


Inactive 

(High) 

Undefined 

(Low or High) 


Inactive 

(Low) 

Undefined 

(Low or High) 



After the first FINIT or FNINIT instruction, FERR# 
pin and the FPU status word register bits (0-7) will 
be inactive irrrespective of the Built-in Self-Test 
(BIST). 
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NOTES: 

1. RESET is an asynchronous input. t2o must be met only to guarantee recognition on a specific clock edge. 

2a. When A20M# is driven synchronously, It must be driven high (inactive) for the CLK edge prior to the falling edge of RESET to ensure proper operation. A20M# 
setup and hold times must be met. 

2b. When A20M# is driven asynchronously, it must be driven high (inactive) for two CLKs prior to and two CLKs after the falling edge of RESET to ensure proper 
operation. 

3a. When FLUSH # Is driven synchronously, it should be driven low (active) for the CLK edge prior to the falling edge of RESET to invoke the Tri-State Output Test 
Mode. All outputs are guaranteed tri-stated within 10 CLKs of RESET being deasserted. FLUSH # setup and hold times must be met 

3b. When FLUSH # is driven asynchronously, it must be driven low (active) for two CLKs prior to and two CLKs after the falling edge of RESET to invoke the Tri- 
State Output Test Mode. All outputs are guaranteed tri-stated within 1 CLKs of RESET being deasserted. 
3c. FLUSH # must be driven high (inactive) during Build-in-Self-Test (BIST). 

4. AHOLD should be driven high (active) for the CLK edge prior to the falling edge of RESET to invoke the Built-in-Self-Test (BIST). AHOLD setup and hold times 
must be met 

5. Hold is recognized normally during RESET. 

6. 15 CLKs RESET pulse width for warm resets. Power-up resets require RESET to be asserted for at least 1 ms after Vcc and CLK are stable. 
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7.0 BUS OPERATION 



7. 1 Data Transfer Mechanism 

All data transfers occur as a result of one or more 
bus cycles. Logical data operands of byte, word and 
dword lengths may be transferred without restric- 
tions on physical address alignment. Data may be 
accessed at any byte boundary but two or three cy- 
cles may be required for unaligned data transfers. 
See Section 7.1 .3 Dynamic Bus Sizing and 7.1 .6 Op- 
erand Alignment. 

The Intel486 Microprocessor address signals are 
split into two components. High-order address bits 
are provided by the address lines, A2-A31 . The byte 
enables, BE0#-BE3#, form the low-order address 
and provide linear selects for the four bytes of the 
32-bit address bus. 

The byte enable outputs are asserted when their as- 
sociated data bus bytes are involved with the pres- 
ent bus cycle, as listed in Table 7.1. Byte enable 
patterns which have a negated byte enable separat- 
ing two or three asserted byte enables will never 
occur (see Table 7.5). All other byte enable patterns 
are possible. 

Table 7.1. Byte Enables and Associated 
Data and Operand Bytes 



Byte 
Enable 
Signal 


Associated Data Bus Signals 


BEO# 


D0-D7 (byte 0— least significant) 


BE1# 


D8-D15 (bytel) 


BE2# 


D16-D23 (byte 2) 


BE3# 


D24-D31 (byte 3— most significant) 



Address bits AO and A1 of the physical operand's 
base address can be created when necessary. Use 
of the byte enables to create AO and A1 is shown in 
Table 7.2. The byte enables can also be decoded to 
generate BLE# (byte low enable) and BHE# (byte 
high enable). These signals are needed to address 
16-bit memory systems (see Section 7.1.4 Inter- 
facing with 8- and 16-bit memories). 

Table 7.2. Generating A0-A31 from 
BE0#-BE3# and A2-A31 



A31 


lntel486TM CPU Address Signals 
A2 BE3# BE2# BE1# 


BEO# 


A31 


Physical Base 
Address 












A2 


A1 


AO 


A31 




A2 








X 


X 


X 


Low 




A31 




A2 





1 


X 


X 


Low 


High 


A31 




A2 


1 





X 


Low 


High 


High 




A31 




A2 


1 


1 


Low 


High 


High 


High 



7.1.1 MEMORY AND I/O SPACES 

Bus cycles may access physical memory space or 
I/O space. Peripheral devices in the system may ei- 
ther be memory-mapped, or l/0-mapped, or both. 
Physical memory addresses range from OOOOOOOOH 
to FFFFFFFFH (4 gigabytes). I/O addresses range 
from OOOOOOOOH to OOOOFFFFH (64 Kbytes) for pro- 
grammed I/O. See Figure 7.1. 
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FFFFFFFFH 



PHYSICAL 
MEMORY 



4GBYTE 



OOOOFFFFH 



OOOOOOOOH ■ ' OOOOOOOOH 

Physical Memory Space 



64 k BYTE 



ACCESSIBLE 
PROGRAMMED 
I/O SPACE 



240440-33 



I/O Space 



Figure 7.1. Physical l\/lemory and I/O Spaces 



7.1.2 



MEMORY AND I/O SPACE 
ORGANIZATION 



The Intel486 Microprocessor datapath to memory 
and input/output (I/O) spaces can be 32-, 16- or 
8-bits wide. The byte enable signals, BE0#-BE3#, 
allow byte granularity when addressing any memory 
or I/O structure whether 8, 16 or 32 bits wide. 

The Intel486 Microprocessor includes bus control 
pins, BS16# and BS8#, which allow direct connec- 
tion to 16- and 8-bit memories and I/O devices. Cy- 
cles to 32-, 16- and 8-bit may occur in any se- 
quence, since the BS8# and BS16# signals are 
sampled during each bus cycle. 

32-bit wide memory and I/O spaces are organized 
as arrays of physical 4-byte words. Each memory or 
I/O 4-byte word has four individually addressable 
bytes at consecutive byte addresses (see Figure 
7.2). The lowest addressed byte is associated with 
data signals D0-D7; the highest-addressed byte 
with D24-D31. Physical 4-byte words begin at ad- 
dresses divisible by four. 



32-Bit Wide Organization 

FFFFFFFFH l | | 1 1 FFFFFFFCH 



00000003H 



OOOOOOOOH 



BE3# BE2# BE1# BEO# 



240440-34 



16-Bit Wide Organization 

FFFFFFFFH I I I FFFFFFFEH 



00000001 H 



OOOOOOOOH 



BHE# BLE# 



240440-35 



Figure 7.2. Physical Memory 
and I/O Space Organization 
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16-bit memories are organized as arrays of physical 
2-byte words. Physical 2-byte words begin at ad- 
dresses divisible by two. The byte enables BEO#- 
BE3#, must be decoded to A1, BLE# and BHE# to 
address 16-bit memories (see Section 7.1.4). 

To address 8-bit memories, the two low order ad- 
dress bits AO and A1 , must be decoded from BEO# - 
BE3#. The same logic can be used for 8- and 16-bit 
memories since the decoding logic for BLE# and AO 
are the same (see Section 7.1.4). 

7.1.3 DYNAMIC DATA BUS SIZING 

Dynamic data bus sizing is a feature allowing proc- 
essor connection to 32-, 1 6- or 8-bit buses for mem- 
ory or I/O. A processor may connect to ail three bus 
sizes. Transfers to or from 32-, 16- or 8-bit devices 
are supported by dynamically determining the bus 
width during each bus cycle. Address decoding cir- 
cuitry may assert BS16# for 16-bit devices, or 
BS8# for 8-bit devices during each bus cycle. BS8# 
and BS16# must be negated when addressing 32- 
bit devices. An 8-blt bus width is selected if both 
BS16# and BS8# are asserted. 

BS16# and BS8# force the Intel486 Microproces- 
sor to run additional bus cycles to complete re- 
quests larger than 16- or 8 bits. A 32-bit transfer will 
be converted into two 16-bit transfers (or 3 transfers 
if the data is misaligned) when BS16# is asserted. 
Asserting BS8# will convert a 32-bit transfer into 
four 8-bit transfers. 

Extra cycles forced by BS16# or BS8# should be 
viewed as independent bus cycles. BS16# or BS8# 
must be driven active during each of the extra cycles 
unless the addressed device has the ability to 
change the number of bytes it can return between 
cycles. 



The Intel486 Microprocessor will drive the byte en- 
ables appropriately during extra cycles forced by 
BS8# and BS16#. A2-A31 will not change if ac- 
cesses are to a 32-bit aligned area. Table 7.3 shows 
the set of byte enables that will be generated on the 
next cycle for each of the valid possibilities of the 
byte enables on the current cycle. 

The dynamic bus sizing feature of the Intel486 Mi- 
croprocessor is significantly different than that of the 
386 Microprocessor. Unlike the 386 Microprocessor, 
the Intel486 Microprocessor requires that data bytes 
be driven on the addressed data pins. The simplest 
example of this function is a 32-bit aligned, BS16# 
read. When the Intel486 Microprocessor reads the 
two high order bytes, they must be driven on the 
data bus pins D16-D31. The Intel486 Microproces- 
sor expects the two low order bytes on D0-D15. 
The 386 Microprocessor expects both the high and 
low order bytes on D0-D15. The 386 Microproces- 
sor always reads or writes data on the lower 1 6 bits 
of the data bus when BS16# is asserted. 

The external system must contain buffers to enable 
the Intel486 Microprocessor to read and write data 
on the appropriate data bus pins. Table 7.4 shows 
the data bus lines where the Intel486 Microproces- 
sor expects data to be returned for each valid com- 
bination of byte enables and bus sizing options. 

Valid data will only be driven onto data bus pins cor- 
responding to active byte enables during write cy- 
cles. Other pins in the data bus will be driven but 
they will not contain valid data. Unlike the 386 Micro- 
processor, the Intel486 Microprocessor will not du- 
plicate write data onto parts of the data bus for 
which the corresponding byte enable is negated. 







Table 7.3 


. Next Byte Enable Values for BSn# Cycles 






Current 




Next with BS8# 


Next with BS16# 




BE3# 


BE2# BE1# 


BEO# 


BE3# BE2# BE1# BEO# 


BE3# BE2# BE1# 


BEO# 


1 


1 1 





n n n n 


n n n 


n 


1 


1 





110 1 


n n n 


n 


1 








10 1 


1 1 


1 











1 


1 


1 


1 


1 




n n n n 


n n n 


n 


1 







10 11 


1 1 


1 










11 


1 


1 


1 


1 




n n n n 


n n n 


n 





1 




111 


n n n 


n 





1 1 




n n n n 


n n n 


n 



"n" means that another bus cycle will not be required to satisfy the request. 



100 



intel. 



lntel486TM DX MICROPROCESSOR 



IP[^iyi)^OC!Q^I^Y 







Table 7.4. Data Pins Read with Different Bus Sizes 




BE3# 


BE2# 


BE1# BEO# 


w/oBS8#/BS16# 


wBS8# 


WBS16# 


1 


1 


1 


D7-D0 


D7-D0 


D7-D0 


1 


1 





D15-D0 


D7-D0 


D15-D0 


1 








D23-D0 


D7-D0 


D15-D0 











D31-D0 


D7-D0 


D15-D0 


1 


1 


1 


D15-D8 


D15-D8 


D15-D8 


1 





1 


D23-D8 


D15-D8 


D15-D8 








1 


D31-D8 


D15-D8 


D15-D8 


1 





1 1 


D23-D16 


D23-D16 


D23-D16 








1 1 


D31-D16 


D23-D16 


D31-D16 





1 


1 1 


D31-D24 


D31-D24 


D31-D24 



7.1.4 INTERFACING WITH 8-. 
IVIEMORIES 



16- AND 32-BIT 



In 32-bit physical memories such as Figure 7.3, each 
4-byte word begins at a byte address that is a multi- 
ple of four. A2-A31 are used as a 4-byte word se- 
lect. BE0#-BE3# select individual bytes within the 
4-byte word. BS8# and BS16# are negated for all 
bus cycles involving the 32-bit array. 



CPU 



32, DATA BUS (D0-D31) 

< 7^ 

ADDRESS BUS (BE0#-BE3#,A2-A31) 



BS8# BS1 

'HIGH" "HIGH" 



32-BIT 
MEMORY 



Figure 7.3. lntel486TM Microprocessor 
with 32-Bit Memory 



1 6- and 8-bit memories require external byte swap- 
ping logic for routing data to the appropriate data 
lines and logic for generating BHE#, BLE# and A1. 
In systems where mixed memory widths are used, 
extra address decoding logic is necessary to assert 
BS16# orBS8#. 

Figure 7.4 shows the Intel486 microprocessor ad- 
dress bus interface to 32-, 16- and 8-bit memories. 
To address 1 6-bit memories the byte enables must 
be decoded to produce A1, BHE# and BLE# (AO). 
For 8-bit wide memories the byte enables must be 
decoded to produce AO and A1 . The same byte se- 
lect logic can be used in 1 6- and 8-bit systems since 
BLE# is exactly the same as AO (see Table 7.5). 

BE0#-BE3# can be decoded as shown in Table 
7.5 to generate A1, BHE# and BLE#. The byte se- 
lect logic necessary to generate BHE# and BLE# is 
shown in Figure 7.5. 
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Figure 7.4. Addressing 16- and 8-Bit Memories 
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Table 7.5. Generating A1, BHE# and BLE# for Addressing 16-Blt Devices 


lntel486TM CPU Signals 


8, 16-Blt Bus Signals 


Comments 


BE3# 


BE2# 


BE1# 


BEO# 


A1 


BHE# 


BLE# (AO) 


H* 


H* 


H* 


H* 


X 


X 


X 


X— no active bytes 


H 


H 


H 




L 


H 


L 




H 


H 


L 




L 


L 


H 




H 


H 


L 




L 


L 


L 




H 


L 


H 


H 


H 


H 


L 




H* 


L* 


H* 


L* 


X 


X 


X 


X— not contiguous bytes 


H 


L 


L 




L 


L 


H 




H 


L 


L 




L 


L 


L 




L 


H 


H 




H 


L 


H 




L* 


H* 


H* 


L* 


X 


X 


X 


X— not contiguous bytes 


L* 


H* 


L* 


H* 


X 


X 


X 


X— not contiguous bytes 


L* 


H* 


L* 


L* 


X 


X 


X 


X— not contiguous bytes 


L 


L 


H 




H 


L 


L 




L* 


L* 


H* 


L* 


X 


X 


X 


X— not contiguous bytes 


L 


L 


L 


H 


L 


L 


H 




L 


L 


L 




L 


L 


L 




BLE# asserted when D0-D7 of 1 6-bit bus Is active. 




BHE# asserted when D8-D15 of 16-bit bus Is active. 




A1 lowfc 


)r all even words; A1 high for all odd words. 




Key: 






X = don't care 




H = high voltage level 




L = low voltage level 




* = a non-occurring pattern of Byte Enables; either none are asserted, 







r the pattern has Byte Enables asserted for non-contiguous bytes 








BEO# BE1# ^ 






\^ 1^^ A1 > 


i/^_h^/\ BHE# 




BE1# LJO 1>0— BE3# L^ 


|0— 1^>0 ^ 




240440-38 
BEO# . 


240440-39 




B 


E2# 


] jo 1 V. BLE# (OR AO) 








-1 /" 




BEO# ^^ 










240440-40 



Figure 7.5. Logic to Generate A1, BHE# and BLE# for 16-Bit Busses 



Combinations of BE0#-BE3# which never occur 
are those in which two or three asserted byte en- 
ables are separated by one or more negated byte 
enables. These combinations are "don't care" con- 
ditions in the decoder. A decoder can use the non- 
occurring BE0#-BE3# combinations to its best ad- 
vantage. 



Figure 7.6 shows an Intel486 Microprocessor data 
bus interface to 16- and 8-bit wide memories. Exter- 
nal byte swapping logic is needed on the data lines 
so that data is supplied to, and received from the 
Intel486 Microprocessor on the correct data pins 
(see Table 7.4). 
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Figure 7.6. Data Bus Interface to 16- and 8-bit l\/lemories 



7.1.5 



DYNAIVIIC BUS SIZING DURING CACHE 
LINE FILLS 



BS8# and BS16# can be driven during cache line 
fills. The Intel486 Microprocessor will generate 
enough 8- or 16-bit cycles to fill the cache line. This 
can be up to 16 8-bit cycles. 

The external system should assume that all byte en- 
ables are active for the first cycle of a cache line fill. 
The Intel486 Microprocessor will generate proper 
byte enables for subsequent cycles in the line fill. 
Table 7.6 shows the appropriate AO (BLE#), A1 and 
BHE# for the various combinations of the Intel486 
Microprocessor byte enables on both the first and 
subsequent cycles of the cache line fill. The "*" 
marks all combinations of byte enables that will be 
generated by the Intel486 Microprocessor during a 
cache line fill. 



7.1.6 OPERAND ALIGNMENT 

Physical 4-byte words begin at addresses that are 
multiples of four. It is possible to transfer a logical 
operand that spans more than one physical 4-byte 
word of memory or I/O at the expense of extra cy- 
cles. Examples are 4-byte operands beginning at ad- 
dresses that are not evenly divisible by 4, or 2-byte 
words split between two physical 4-byte words. 
These are referred to as unaligned transfers. 

Operand alignment and data bus size dictate when 
multiple bus cycles are required. Table 7.7 describes 
the transfer cycles generated for all combinations of 
logical operand lengths, alignment, and data bus siz- 
ing. When multiple cycles are required to transfer a 
multi-byte logical operand, the highest-order bytes 
are transferred first. For example, when the proces- 
sor does a 4-byte unaligned read beginning at loca- 
tion x1 1 in the 4-byte aligned space, the three high 
order bytes are read in the first bus cycle. The low 
byte is read in a subsequent bus cycle. 



Table 7.6. Generating AO, A1 and BHE# from the lntel486TM Microprocessor Byte Enables 


BE3# 


BE2# BE1# BEO# 


First Cache Fill Cycle 


Any Other Cycle 






AO A1 BHE# 


AO A1 BHE# 


1 


1 1 





1 


1 


1 








1 











*0 











1 


1 1 





1 


1 


1 





1 


*0 


1 





1 


1 


1 1 





1 1 


*0 


1 1 





1 


*0 


1 1 1 





1 1 
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Table 7.7. Transfer Bus Cycles for Bytes, Words and Dwords 








Byte-Length of Logical Operand 




1 


2 


4 


Physical Byte Address in 
l\/lemory (Low Order Bits) 


XX 


00 


01 


10 


11 


00 


01 


10 


11 


Transfer Cycles 
over 32-Blt Bus 


b 


w 


w 


w 


hb 
Ib 


d 


hb 
13 


hw 
Iw 


h3 
Ib 


Transfer Cycles over 
16-Bit Data Bus 
= BS1 6 # Asserted 


b 


w 


ib 
hb 


w 


hb 
Ib 


ilil 


hb 


hw 
Iw 


^ 


lb 
mw 






Ib 


Transfer Cycles over 
8-Bit Data Bus 
= BS8# Asserted 


b 


1 


lb 
hb 


ib 
hb 


hb 
Ib 


II 


hb 


IB 


M 


ib 

rtilb 
mhb 


WSi 


lb 



KEY: 

b = byte transfer 
w = 2-byte transfer 
3 = 3-byte transfer 
d = 4-byte transfer 



h = high-order portion 
I = low-order portion 
m = mid-order portion 



The function of unaligned transfers with dynamic 
bus sizing is not obvious. When the external systems 
asserts BS16# or BS8# forcing extra cycles, low- 
order bytes or words are transferred first (opposite 
to the example above). When the Intel486 Micro- 
processor requests a 4-byte read and the external 
system asserts BS16#, the lower 2 bytes are read 
first followed by the upper 2 bytes. 

In the unaligned transfer described above, the proc- 
essor requested three bytes on the first cycle. If the 
external system asserted BS16# during this 3-byte 
transfer, the lower word is transferred first followed 
by the upper byte. In the final cycle the lower byte of 
the 4-byte operand is transferred as in the 32-bit ex- 
ample above. 



4-Byte Operand 



Ib 


mlb 


mhb 


hb 



t 

byte with 

lowest 

address 



t 

byte with 
highest 
address 



This section begins with basic non-cacheable non- 
burst single cycle transfers. It moves on to multiple 
cycle transfers and introduces the burst mode. 
Cacheability is introduced in Section 7.2.3. The re- 
maining sections describe locked, pseudo-locked, 
invalidate, bus hold and interrupt cycles. 

Bus cycles and data cycles are discussed in this 
section. A bus cycle is at least two clocks long and 
begins with ADS# active in the first clock and ready 
active in the last clock. Data is transferred to or from 
the Intel486 Microprocessor during a data cycle, A 
bus cycle contains one or more data cycles. 

Refer to Section 7.2.13 for a description of the bus 
states shown In the timing diagrams. 



7.2 Bus Functional Description 

The Intel486 Microprocessor supports a wide variety 
of bus transfers to meet the needs of high perform- 
ance systems. Bus transfers can be single cycle or 
multiple cycle, burst or non-burst, cacheable or non- 
cacheable, 8-, 16- or 32-bit, and pseudo-locked. To 
support multiprocessing systems there are cache in- 
validation cycles and locked cycles. 



7.2.1 



NON-CACHEABLE NON-BURST SINGLE 
CYCLE 



7.2.1.1 No Wait States 

The fastest non-burst bus cycle that the Intel486 Mi- 
croprocessor supports is two clocks long. These cy- 
cles are called 2-2 cycles because reads and writes 
take two cycles each. The first 2 refers to reads and 
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the second to writes. For example, if a wait state 
needs to be added to a write, the cycle would be 
called 2-3. 

Basic two clock read and write cycles are shown in 
Figure 7.7. The Intel486 Microprocessor initiates a 
cycle by asserting the address status signal (ADS#) 
at the rising edge of the first clock. The ADS# out- 
put indicates that a valid bus cycle definition and 
address is available on the cycle definition lines and 
address bus. 

The non-burst ready input (RDY#) is returned by the 
external system in the second clock. RDY# Indi- 
cates that the external system has presented valid 
data on the data pins In response to a read or the 
external system has accepted data in response to a 
write. 



7.2.2 MULTIPLE AND BURST CYCLE BUS 
TRANSFERS 

Multiple cycle bus transfers can be caused by inter- 
nal requests from the Intel486 Microprocessor or by 
the external memory system. An internal request for 
a 64-bit floating point load or a 128-bit pre-fetch 
must take more than one cycle. Internal requests for 
unaligned data may also require multiple bus cycles. 
A cache line fill requires multiple cycles to complete. 
The external system can cause a multiple cycle 
transfer when it can only supply 8 or 16 bits per 
cycle. 

Only multiple cycle transfers caused by internal re- 
quests are considered in this section. Cacheable cy- 
cles and 8- and 1 6-bit transfers are covered in Sec- 
tions 7.2.3 and 7.2.5. 



The Intel486 Microprocessor samples RDY# at the 
end of the second clock. The cycle is complete if 
RDY# is active (LOW) when sampled. Note that 
RDY# is ignored at the end of the first clock of the 
bus cycle. 

The burst last signal (BLAST#) is asserted (LOW) 
by the Intel486 Microprocessor during the second 
clock of the first cycle in all bus transfers illustrated 
in Figure 7.7. This indicates that each transfer is 
complete after a single cycle. The Intel486 Micro- 
processor asserts BLAST # In the last cycle of a bus 
transfer. 

The timing of the parity check output (PCHK#) is 
shown in Figure 7.7. The Intel486 Microprocessor 
drives the PCHK# output one clock after ready ter- 
minates a read cycle. PCHK# indicates the parity 
status for the data sampled at the end of the previ- 
ous clock. The PCHK# signal can be used by the 
external system. The Intel486 Microprocessor does 
nothing in response to the PCHK# output. 

7.2.1.2 Inserting Wait States 

The external system can insert wait states into the 
basic 2-2 cycle by driving RDY# Inactive at the end 
of the second clock. RDY# must be driven inactive 
to insert a wait state. Figure 7.8 illustrates a simple 
non-burst, non-cacheable signal with one wait state 
added. Any number of wait states can be added to 
an Intel486 Microprocessor bus cycle by maintaining 
RDY# inactive. 

The burst ready input (BRDY#) must be driven inac- 
tive on all clock edges where RDY# Is driven inac- 
tive for proper operation of these simple non-burst 
cycles. 



7.2.2.1 Burst Cycles 

The Intel486 Microprocessor can accept burst cy- 
cles for any bus requests that require more than a 
single data cycle. During burst cycles, a new data 
item is strobed into the Intel486 Microprocessor ev- 
ery clock rather than every other clock as in non- 
burst cycles. The fastest burst cycle requires 2 
clocks for the first data item with subsequent data 
items returned every clock. 

The Intel486 Microprocessor is capable of bursting a 
maximum of 32 bits during a write. Burst writes can 
only occur if BS8# or BS16# is asserted. For exam- 
ple, the Intel486 Microprocessor can burst write four 
8-bit operands or two 16-bit operands in a single 
burst cycle. But the Intel486 Microprocessor cannot 
burst multiple 32-bit writes In a single burst cycle. 

Burst cycles begin with the Intel486 Microprocessor 
driving out an address and asserting ADS# in the 
same manner as non-burst cycles. The Intel486 mi- 
croprocessor indicates that it is willing to perform a 
burst cycle by holding the burst last signal 
(BLAST#) inactive in the second clock of the cycle. 
The external system Indicates its willingness to do a 
burst cycle by returning the burst ready signal 
(BRDY#) active. 

The addresses of the data items in a burst cycle will 
all fall within the same 16-byte aligned area (corre- 
sponding to an internal Intel486 Microprocessor 
cache line). A 16-byte aligned area begins at loca- 
tion XXXXXXXO and ends at location XXXXXXXF. 
During a burst cycle, only BE0-3#, A2, and A3 may 
change. A4-A31, M/IO#, D/C#, and W/R# will re- 
main stable throughout a burst. Given the first ad- 
dress in a burst, external hardware can easily calcu- 
late the address of subsequent transfers in advance. 
An external memory system can be designed to 
quickly fill the Intel486 microprocessor internal 
cache lines. 
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Figure 7.7. Basic 2-2 Bus Cycle 
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Figure 7.8. Basic 3-3 Bus Cycle 
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Burst cycles are not limited to cache line fills. Any 
multiple cycle read request by the Intel486 Micro- 
processor can be converted into a burst cycle. The 
Intei486 Microprocessor will only burst the number 
of bytes needed to complete a transfer. For exam- 
ple, eight bytes will be bursted in for a 64-bit floating 
point non-cacheable read. 

The external system converts a multiple cycle re- 
quest into a burst cycle by returning BRDY# active 
rather than RDY# (non-burst ready) in the first cycle 
of a transfer. For cycles that cannot be bursted such 
as interrupt acknowledge and halt, BRDY# has the 
same effect as RDY#. BRDY# is ignored if both 
BRDY# and RDY# are returned in the same clock. 
Memory areas and peripheral devices that cannot 
perform bursting must terminate cycles with RDY#. 

7.2.2.2 Terminating Multiple and 
Burst Cycle Transfers 

The Intel486 Microprocessor drives BLAST# inac- 
tive for all but the last cycle in a multiple cycle trans- 
fer. BLAST# is driven Inactive in the first cycle to 
inform the external system that the transfer could 
take additional cycles. BLAST# is driven active in 
the last cycle of the transfer indicating that the next 
time BRDY# or RDY# is returned the transfer is 
complete. 

BLAST # is not valid In the first clock of a bus cycle. 
It should be sampled only in the second and subse- 
quent clocks when RDY# or BRDY# is returned. 

The number of cycles in a transfer Is a function of 
several factors including the number of bytes the mi- 
croprocessor needs to complete an internal request 
(1, 2, 4, 8, or 16), the state of the bus size inputs 
(BS8# and BS16#), the state of the cache enable 
input (KEN#) and alignment of the data to be trans- 
ferred. 

When the Intel486 Microprocessor initiates a re- 
quest it knows how many bytes will be transferred 
and if the data is aligned. The external system must 
tell the microprocessor whether the data is cache- 
able (if the transfer is a read) and the width of the 
bus by returning the state of the KEN#, BS8# and 
BS16# inputs one clock before RDY# or BRDY# is 
returned. The Intel486 Microprocessor determines 
how many cycles a transfer will take based on its 
Internal information and inputs from the external sys- 
tem. 

BLAST # is not valid in the first clock of a bus cycle 
because the Intel486 Microprocessor cannot deter- 
mine the number of cycles a transfer will take until 



the external system returns KEN#, BS8# and 
BS16#. BLAST# should only be sampled in the 
second and subsequent clocks of a cycle when the 
external system returns RDY# or BRDY#. 

The system may terminate a burst cycle by returning 
RDY# instead of BRDY#. BLAST # will remain 
deasserted until the last transfer. However, any 
transfers required to complete a cache line fill will 
follow the burst order, e.g., if burst order was 4, 0, C, 
8 and RDY# was returned at after 0, the next trans- 
fers will be from C and 8. 



7.2.2.3 Non-Cacheable, Non-Burst, Multiple 
Cycle Transfers 

Figure 7.9 illustrates a 2 cycle non-burst, non-cache- 
able multiple cycle read. This transfer is simply a 
sequence of two single cycle transfers. The Intel486 
Microprocessor indicates to the external system that 
this is a multiple cycle transfer by driving BLAST # 
inactive during the second clock of the first cycle. 
The external system returns RDY# active indicjating 
that it will not burst the data. The external system 
also indicates that the data is not cacheable by re- 
turning KEN# inactive one clock before it returns 
RDY# active. When the Intel486 Microprocessor 
samples RDY# active It ignores BRDY#. 

Each cycle in the transfer begins when ADS# is 
driven active and the cycle is complete when the 
external system returns RDY# active. 

The Intel486 Microprocessor indicates the last cycle 
of the transfer by driving BLAST # active. The next 
RDY# returned by the external system terminates 
the transfer. 



7.2.2.4 Non-Cacheable Burst Cycles 

The external system converts a multiple cycle re- 
quest into a burst cycle by returning BRDY# active 
rather than RDY# in the first cycle of the transfer. 
This is illustrated in Figure 7.10. 

There are several features to note in the burst read. 
ADS# is only driven active during the first cycle of 
the transfer. RDY# must be driven inactive when 
BRDY# is returned active. 

BLAST # behaves exactly as it does in the non-burst 
read. BLAST# Is driven inactive in the second clock 
of the first cycle of the transfer indicating more cy- 
cles to follow. In the last cycle, BLAST # is driven 
active telling the external memory system to end the 
burst after returning the next BRDY#. 
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Figure 7.9. Non-Cacheable, Non-Burst, Multiple Cycle Transfers 
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Figure 7.10. Non-Cacheable Burst Cycle 
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7.2.3 CACHEABLE CYCLES 

Any memory read can become a cache fill operation. 
The external memory system can allow a read re- 
quest to fill a cache line by returning KEN# active 
one clock before RDY# or BRDY# during the first 
cycle of the transfer on the external bus. Once 
KEN# is asserted and the remaining three require- 
ments described below are met, the Intel486 Micro- 
processor will fetch an entire cache line regardless 
of the state of KEN#. KEN# must be returned ac- 
tive in the last cycle of the transfer for the data to be 
written into the internal cache. The Intel486 Micro- 
processor will only convert memory reads or pre- 
fetches into a cache fill. 



7.2.3.1 Byte Enables during a Cache Line Fill 

For the first cycle in the line fill, the state of the byte 
enables should be ignored. In a non-cacheable 
memory read, the byte enables indicate the bytes 
actually required by the memory or code fetch. 

The Intel486 Microprocessor expects to receive val- 
id data on its entire bus (32 bits) in the first cycle of a 
cache line fill. Data should be returned with the as- 
sumption that all the byte enable pins are driven ac- 
tive. However if BS8# is asserted only one byte 
need be returned on data lines D0-D7. Similarly If 
BS16# is asserted two bytes should be returned on 
D0-D15. 



KEN# is ignored during write or I/O cycles. Memory 
writes will only be stored in the on-chip cache if 
there is a cache hit. I/O space is never cached in 
the internal cache. 

To transform a read or a prefetch into a cache line 
fill the following conditions must be met: 

1 . The KEN# pin must be asserted one clock pri- 
or to RDY# or BRDY# being returned for the 
first data cycle. 

2. The cycle must be of the type that can be inter- 
nally cached. (Locked reads, I/O reads, and 
interrupt acknowledge cycles are never cach- 
ed). 

3. The page table entry must have the page 
cache disable bit (PCD) set to 0. To cache a 
page table entry, the page directory must have 
PCD = 0. To cache reads or prefetches when 
paging is disabled, or to cache the page direc- 
tory entry, control register 3 (CR3) must have 
PCD = 0. 

4. The cache disable (CD) bit in control register 
(CRO) must be clear. 

External hardware can determine when the Intel486 
Microprocessor has transformed a read or prefetch 
into a cache fill by examining the KEN#, M/IO#, 
D/C#, W/R#, LOCK#, and PCD pins. These pins 
convey to the system the outcome of conditions 1 -3 
in the above list. In addition, the Intel486 drives PCD 
high whenever the CD bit in CRO is set, so that ex- 
ternal hardware can evaluate condition 4. 

Cacheable cycles can be burst or non-burst. 



The Intel486 Microprocessor will generate the ad- 
dresses and byte enables for all subsequent cycles 
in the line fill. The order in which data is read during 
a line fill depends on the address of the first item 
read. Byte ordering is discussed in Section 7.2.4. 

7.2.3.2 Non-Burst Cacheable Cycles 

Figure 7.1 1 shows a non-burst cacheable cycle. The 
cycle becomes a cache fill when the Intel486 Micro- 
processor samples KEN# active at the end of the 
first clock. The Intel486 Microprocessor drives 
BLAST# inactive in the second clock in response to 
KEN#. BLAST # is driven inactive because a cache 
fill requires 3 additional cycles to complete. 
BLAST# remains inactive until the last transfer in 
the cache line fill. KEN# must be returned active in 
the last cycle of the transfer for the data to be writ- 
ten into the internal cache. 

Note that this cycle would be a single bus cycle if 
KEN # was not sampled active at the end of the first 
clock. The subsequent three reads would not have 
happened since a cache fill was not requested. 

The BLAST # output is invalid in the first clock of a 
cycle. BLAST # may be active during the first clock 
due to earlier inputs. Ignore BLAST# until the sec- 
ond clock. 

During the first cycle of the cache line fill the exter- 
nal system should treat the byte enables as if they 
are ail active. In subseqilient cycles in the burst, the 
Intel486 Microprocessor drives the address lines 
and byte enables (see Section 7.2.4.2 for Burst and 
Cache Line Fill Order). 
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Figure 7.11. Non-Burst, Cacheable Cycles 



7.2.3.3 Burst Cacheable Cycles 

Figure 7.12 illustrates a burst mode cache fill. As in 
Figure 7.11, the transfer becomes a cache line fill 
when the external system returns KEN# active at 
the end of the first clock in the cycle. 



The external system informs the Intel486 Microproc- 
essor that it will burst the line in by driving BRDY# 
active at the end of the first cycle in the transfer. 

Note that during a burst cycle ADS# is only driven 
with the first address. 
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Figure 7.12. Burst Cacheable Cycle 



7.2.3.4 Effect of Changing KEN# during a 
Cache Line Fili 

KEN# can change multiple times as long as it ar- 
rives at its final value in the clock before RDY# or 
BRDY# is returned. This is illustrated in Figure 7.13. 
Note that the timing of BLAST# follows that of 
KEN# by one clock. The Intel486 samples KEN# 
every clock and uses the value returned in the clock 
before ready to determine if a bus cycle would be a 



cache line fill. Similarly, it uses the value of KEN# in 
the last cycle, before early RDY# to load the line 
just retrieved from the memory into the cache. 
KEN# is sampled every clock, it must satisfy setup 
and hold time. 

KEN # can also change multiple times before a burst 
cycle as long as it arrives at its final value one clock 
before ready Is returned active. 
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Figure 7.13. Effect of Changing KEN# 



7.2.4 BURST IVIODE DETAILS 

7.2.4.1 Adding Wait States to Burst Cycles 

Burst cycles need not return data on every clock. 
The Intel486 Microprocessor will only strobe data 
into the chip when either RDY# or BRDY# are ac- 
tive. 



Driving BRDY# and RDY# inactive adds a wait 
state to the transfer. A burst cycle where two clocks 
are required for every burst item is shown in Figure 
7.14. 
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Figure 7.14. Slow Burst Cycle 



7.2.4.2 Burst and Cache Line Fill Order 

The burst order used by the Intel486 Microprocessor 
is shown in Table 7.8. This burst order is followed by 
any burst cycle (cache or not), cache line fill (burst 
or not) or code prefetch. 

The microprocessor presents each request for data 
in an order determined by the first address in the 
transfer. For example, if the first address was 104 
the next three addresses in the burst will be 100, 
IOC and 108. 



Table 7.8. Burst Order 



First 


Second 


Third 


Fourth 


Addr. 


Addr. 


Addr. 


Addr. 





4 


8 





4 





C 


8 


8 


C 





4 


C 


8 


4 






An example of burst address sequencing is shown in 
Figure 7.15. 
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Figure 7.15. Burst Cycle Showing Order of Addresses 



The sequences shown in Table 7.7 accommodate 
systems with 64-bit busses as well as systems with 
32-bit data busses. The sequence applies to all 
bursts, regardless of whether the purpose of the 
burst is to fill a cache line, do a 64-blt read, or do a 
pre-fetch. If either BS8# or BS16# is returned ac- 
tive, the Intel486 Microprocessor completes the 
transfer of the current 32-bit word before progress- 
ing to the next 32-bit word. For example, a BS16# 
burst to address 4 has the following order: 4-6-0-2- 
C-E-8-A. 



The Intel486 Microprocessor will automatically gen- 
erate another normal bus cycle after being interrupt- 
ed to complete the data transfer. This is called an 
interrupted burst cycle. The external system can re- 
spond to an interrupted burst cycle with another 
burst cycle. 

The external system can interrupt a burst cycle by 
returning RDY# instead of BRDY#. RDY# can be 
returned after any number of data cycles terminated 
with BRDY#. 



7.2.4.3 Interrupted Burst Cycles 

Some memory systems may not be able to respond 
with burst cycles in the order defined in Table 7.7. 
To support these systems the Intel486 Microproces- 
sor allows a burst cycle to be interrupted at any time. 



An example of an interrupted burst cycle is shown in 
Figure 7.16. The Intel486 Microprocessor immedi- 
ately drives ADS# active to initiate a new bus cycle 
after RDY# is returned active. BLAST # is driven 
inactive one clock after ADS# begins the second 
bus cycle indicating that the transfer is not complete. 
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Figure 7.16. Interrupted Burst Cycle 



KEN # need not be returned active in tlie first data 
cycle of the second part of tire transfer in Figure 
7.16. Tire cycle had been converted to a cache fill in 
the first part of the transfer and the Intel486 Micro- 
processor expects the cache fill to be completed. 
Note that the first half and second half of the trans- 
fer in Figure 7.16 are each two cycle burst transfers. 

The order in which the Intel486 Microprocessor re- 
quests operands during an Interrupted burst transfer 
is determined by Table 7.7. Mixing RDY# and 
BRDY# does not change the order in which oper- 
and addresses are requested by the Intel486 Micro- 
processor. 



An example of the order in which the Intel486 Micro- 
processor requests operands during a cycle in which 
the external system mixes RDY# and BRDY# is 
shown in Figure 7.17. The Intel486 Microprocessor 
initially requests a transfer beginning at location 1 04. 
The transfer becomes a cache line fill when the ex- 
ternal system returns KEN # active. The first cycle of 
the cache fill transfers the contents of location 1 04 
and is terminated with RDY#. The Intel486 Micro- 
processor drives out a new request (by asserting 
ADS#) to address 100. If the external system termi- 
nates the second cycle with BRDY#, the Intel486 
Microprocessor will next request/expect address 
1 0C. The correct order is determined by the first cy- 
cle in the transfer, which may not be the first cycle in 
the burst if the system mixes RDY# with BRDY#. 
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Figure 7.17. Interrupted Burst Cycle with Unobvious Order of Addresses 



7.2.5 8- AND 16-BIT CYCLES 

The Intel486 Microprocessor supports both 16- and 
8-bit external busses through the BS16# and BS8# 
inputs. BS16# and BS8# allow the external system 
to specify, on a cycle by cycle basis, whether the 
addressed component can supply 8, 16 or 32 bits. 
BS16# and BS8# can be used in burst cycles as 
well as non-burst cycles. If both BS16# and BS8# 
are returned active for any bus cycle, the Intel486 
Microprocessor will respond as if only BS8# were 
active. 

The timing of BS16# and BS8# is the same as that 
of KEN#. BS16# and BS8# must be driven active 
before the first RDY# or BRDY# is driven active. 



Driving the BS16# and BS8# active can force the 
Intel486 Microprocessor to run additional cycles to 
complete what would have been only a single 32-bit 
cycle. BS8# and BS16# may change the state of 
BLAST# when they force subsequent cycles from 
the transfer. 

Figure 7.18 shows an example in which BS8# 
forces the Intel486 Microprocessor to run two extra 
cycles to complete a transfer. The Intel486 Micro- 
processor issues a request for 24 bits of information. 
The external system drives BS8# active indicating 
that only eight bits of data can be supplied per cycle. 
The Intel486 Microprocessor issues two extra cycles 
to complete the transfer. 
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Figure 7.18. 8-Bit Bus Size Cycle 



Extra cycles forced by the BS16# and BS8# should 
be viewed as independent bus cycles. BS16# and 
BS8# should be driven active for each additional 
cycle unless the addressed device has the ability to 
change the number of bytes it can return between 
cycles. The Intel486 Microprocessor will drive 
BLAST # inactive until the last cycle before the 
transfer is complete. 

Refer to Section 7.1.3 for the sequencing of ad- 
dresses while BS8# or BS16# are active. 



BS8# and BS16# operate during burst cycles in ex- 
actly the same manner as non-burst cycles. For ex- 
ample, a single non-cacheable read could be trans- 
ferred by the Intel486 Microprocessor as four 8-bit 
burst data cycles. Similarly, a single 32-bit write 
could be written as four 8-bit burst data cycles. An 
example of a burst write is shown in Figure 7.19. 
Burst writes can only occur if BS8# or BS16# is 
asserted. 
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Figure 7.19. Burst Write as a Result of BS8# or BS16# 



7.2.6 LOCKED CYCLES 

Locked cycles are generated in software for any in- 
struction that performs a read-modify-write opera- 
tion. During a read-modify-write operation the proc- 
essor can read and modify a variable in external 
memory and be assured that the variable is not ac- 
cessed between the read and write. 

Locked cycles are automatically generated during 
certain bus transfers. The xchg (exchange) instruc- 
tion generates a locked cycle when one of its oper- 
ands is memory based. Locked cycles are generat- 
ed when a segment or page table entry is updated 
and during interrupt acknowledge cycles. Locked cy- 
cles are also generated when the LOCK instruction 
prefix is used with selected instructions. 



Locked cycles are implemented in hardware with the 
LOCK# pin. When LOCK# is active, the processor 
is performing a read-modify-write operation and the 
external bus should not be relinquished until the cy- 
cle is complete. Multiple reads or writes can be 
locked. A locked cycle is shown in Figure 7.20. 
LOCK# goes active with the address and bus defini- 
tion pins at the beginning of the first read cycle and 
remains active until RDY# is returned for the last 
write cycle. For unaligned 32 bits read-modify-write 
operation, the LOCK# remains active for the entire 
duration of the multiple cycle. It will go inactive when 
RDY# is returned for the last write cycle. 
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Figure 7.20. Locked Bus Cycle 



When LOCK# is active, the Intel486 Microprocessor 
will recognize address hold and backoff but will not 
recognize bus hold. It is left to the external system to 
properly arbitrate a central bus when the Intel486 
Microprocessor generates LOCK#. 

7.2.7 PSEUDO-LOCKED CYCLES 

Pseudo-locked cycles assure that no other master 
will be given control of the bus during operand trans- 
fers which take more than one bus cycle. Examples 
include 64-bit floating point read and writes, 64-bit 
descriptor loads and cache line fills. 

Pseudo-locked transfers are indicated by the 
FLOCK # pin. The memory operands must be 
aligned for correct operation of a pseudo-locked cy- 
cle. 

FLOCK # need not be examined during burst reads. 
A 64-bit aligned operand can be retrieved in one 
burst (note: this is only valid in systems that do not 
interrupt bursts). 

The system must examine FLOCK # during 64-bit 
writes since the Intel486 Microprocessor cannot 
burst write more than 32 bits. However, burst can be 
used within each 32-bit write cycle if BS8# or 
BS16# is asserted. BLAST will be deasserted in re- 
sponse to BS8# or BS16#. A 64-bit write will be 
driven out as two non-burst bus cycles. BLAST# is 
asserted during both writes since a burst is not pos- 



sible. FLOCK # is asserted during the first write to 
indicate that another write follows. This behavior is 
shown in Figure 7.21 . 

The first cycle of a 64-bit floating point write Is the 
only case in which both FLOCK# and BLAST# are 
asserted. Normally FLOCK# and BLAST# are the 
inverse of each other. 

During all of the cycles where FLOCK # is asserted, 
HOLD is not acknowledged until the cycle com- 
pletes. This results in a large HOLD latency, espe- 
cially when BS8# or BS16# is asserted. To reduce 
the HOLD latency during these cycles, windows are 
available between transfers to allow HOLD to be ac- 
knowledged during non-cacheable, non-bursted 
code prefetches. FLOCK # will be asserted since 
BLAST # is negated, but it is ignored and HOLD is 
recognized during the prefetch. 

FLOCK # can change several times during a cycle 
settling to its final value in the clock ready is re- 
turned. 



7.2.8 INVALIDATE CYCLES 

Invalidate cycles are needed to keep the Intel486 
Microprocessor's internal cache contents consistent 
with external memory. The Intel486 microprocessor 
contains a mechanism for listening to writes by other 
devices to external memory. When the processor 
finds a write to a Section of external memory con- 
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Figure 7.21. Pseudo Lock Timing 



tained in its internal cache, the processor's internal 
copy is invalidated. 

Invalidations use two pins, address hold request 
(AHOLD) and valid external address (EADS#). 
There are two steps in an invalidation cycle. First, 
the external system asserts the AHOLD input forcing 
the Intel486 Microprocessor to immediately relin- 
quish its address bus. Next, the external system as- 
serts EADS# indicating that a valid address is on 
the Intel486 Microprocessor's address bus. EADS# 
and the invalidation address. Figure 7-22 shows the 
fastest possible invalidation cycle. The Intel486 cy- 
cle CPU recognizes AHOLD on one CLK edge and 
floats the address bus in response. To allow the ad- 
dress bus to float and avoid contention, EADS# and 
the invalidation address should not be driven until 
the following CLK edge. The microprocessor reads 
the address oyer its address lines. If the microproc- 
essor finds this address in its internal cache, the 
cache entry is invalidated. Note that the Intel486 Mi- 
croprocessor's address bus is input/output unlike 
the 386 Microprocessor's bus, which is output only. 

The Intel486 Microprocessor immediately relinquish- 
es its address bus in the next clock upon assertion 
of AHOLD. For example, the bus could be 3 wait 
states into a read cycle. If AHOLD is activated, the 
Intel486 Microprocessor will immediately float Its 



address bus before ready is returned terminating the 
bus cycle. 

When AHOLD is asserted only the address bus is 
floated, the data bus can remain active. Data can be 
returned for a previously specified bus cycle during 
address hold (see Figures 7.22, 7.23). 

EADS# is normally asserted when an external mas- 
ter drives an address onto the bus. AHOLD need not 
be driven for EADS# to generate an internal invali- 
date. If EADS# alone is asserted while the Intel486 
Microprocessor is driving the address bus, it Is pos- 
sible that the invalidation address will come from the 
Intel486 Microprocessor itself. 

Note that it is also possible to run an invalidation 
cycle by asserting EADS# when HOLD or BOFF# 
is asserted. 

Running an invalidate cycle prevents the Intel486 
Microprocessor cache from satisfying other internal 
requests, so invalidations should be run only when 
necessary. The fastest possible invalidate cycle is 
shown in Figure 7.22, while a more realistic invalida- 
tion cycle is shown in 7.23. Both of the examples 
take one clock of cache access from the rest of the 
Intel486 Microprocessor. 
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Figure 7.22. Fast Internal Cache Invalidation Cycle 
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Figure 7.23. Typical Internal Cache Invalidation Cycle 
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7.2.8.1 Rate of invalidate Cycies 

The Intel486 Microprocessor can accept one invali- 
date per clock except in the last clock of a line fill. 
One invalidate per clock is possible as long as 
EADS# is negated in ONE or BOTH of the following 
cases: 

1. In the clock RDY# or BRDY# is returned for 
the last time. 

2. In the clock following RDY# or BRDY# being 
returned for the last time. 

This definition allows two system designs. Simple 
designs can restrict invalidates to one every other 
clock. The simple design need not track bus activity. 
Alternatively, systems can request one invalidate 
per clock provided that the bus is monitored. 



7.2.8.2 Running Invaiidate Cycles Concurrently 
with Line Fills 

Precautions are necessary to avoid caching stale 
data in the Intel486 Microprocessor's cache in a sys- 
tem with a second level cache. An example of a 
system with a second level cache is shown in Figure 
7.24. An external device can be writing to main 
memory over the system bus while the Intel486 Mi- 
croprocessor is retrieving data from the second level 
cache. The Intel486 Microprocessor will need to in- 
validate a line in its internal cache if the external 
device is writing to a main memory address also 
contained in the Intel486 Microprocessor's cache. 
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Figure 7.24. System with Second Level Cache 

A potential problem exists If the external device is 
writing to an address in external memory, and at the 
same time the Intel486 Microprocessor is reading 
data from the same address in the second level 
cache. The system must force an invalidation cycle 
to invalidate the data that the Intel486 Microproces- 
sor has requested during the line fill. 

If the system asserts EADS# before the first data in 
the line fill is returned to the Intel486 Microproces- 
sor, the system must return data consistent with the 
new data in the external memory upon resumption of 
the line fill after the invalidation cycle. This is illus- 
trated by the asserted EADS# signal labeled 1 in 
Figure 7.25. 
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Figure 7.25. Cache Invalidation Cycle Concurrent with Line Fill 



If the system asserts EADS# at the same time or 
after the first data in the line fill is returned (In the 
same clock that the first RDY# or BRDY# is re- 
turned or any subsequent clock in the line fill) the 
data will be read into the Intel486 Microprocessors 
input buffers but it will not be stored in the on-chip 
cache. This is illustrated by asserted EADS# signal 
labeled 2 in Figure 7.25. The stale data will be used 
to satisfy the request that Initiated the cache fill cy- 
cle. 

7.2.9 BUS HOLD 

The Intel486 Microprocessor provides a bus hold, 
hold acknowledge protocol using the bus hold re- 
quest (HOLD) and bus hold acknowledge (HLDA) 
pins. Asserting the HOLD input indicates that anoth- 
er bus master desires control of the Intel486 Micro- 
processor's bus. The processor will respond by 
floating its bus and driving HLDA active when the 
current bus cycle, or sequence of locked cycles is 
complete. An example of a HOLD/HLDA transaction 
is shown in Figure 7.26. Unlike the 386 Microproces- 



sor, the Intel486 Microprocessor can respond to 
HOLD by floating its bus and asserting HLDA while 
RESET is asserted. 

Note that HOLD will be recognized during un-aligned 
writes (less than or equal to 32-bits) with BLAST # 
being active for each write. For greater than 32-bit or 
un-aligned write, HOLD# recognition is prevented 
by PLOCK# getting asserted. 

The pins floated during bus hold are: BE0#-BE3#, 
PCD, PWT, W/R#, D/C#, M/IO#, LOCK#, 
PLOGK#, ADS#, BLAST#, D0-D31, A2-A31, 
DP0-DP3. 



7.2.10 INTERRUPT ACKNOWLEDGE 

The Intel486 Microprocessor generates interrupt ac- 
knowledge cycles in response to maskable interrupt 
requests generated on the interrupt request input 
(INTR) pin. Interrupt acknowledge cycles have a 
unique cycle type generated on the cycle type pins. 
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Figure 7.26. HOLD/HLDA Cycles 



An example interrupt acknowledge transaction is 
shown in Figure 7.27. Interrupt acknowledge cycles 
are generated in locked pairs. Data returned during 
the first cycle is ignored. The interrupt vector is re- 
turned during the second cycle on the lower 8 bits of 
the data bus. The Intel486 Microprocessor has 256 
possible interrupt vectors. 



The state of A2 distinguishes the first and second 
interrupt acknowledge cycles. The byte address 
driven during the first interrupt acknowledge cycle is 
4 (A31-A3 low, A2 high, BE3#-BE1# high, and 
BEO# low). The address driven during the second 
interrupt acknowledge cycle is (A31-A2 low, 
BE3#-BE1# high, BEO# low). 
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Figure 7.27. Interrupt Acknowledge Cycles 
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Each of the interrupt acknowledge cycles are termi- 
nated when the external system returns RDY# or 
BRDY#. Wait states can be added by withholding 
RDY# or BRDY#. The Intel486 Microprocessor au- 
tomatically generates four idle clocks between the 
first and second cycles to allow for 8259A recovery 
time. 

7.2.11 SPECIAL BUS CYCLES 

The Intel486 Microprocessor provides four special 
bus cycles to indicate that certain instructions have 
been executed, or certain conditions have occurred 
internally. The special bus cycles in Table 7.9 are 
defined when the bus cycle definition pins are in 
the following state: M/IO# = 0, D/C#=0 and 
W/R# = 1. During these cycles the address bus is 
driven low while the data bus is undefined. 

Two of the special cycles indicate halt or shutdown. 
Another special cycle is generated when the In- 
tel486 Microprocessor executes an INVD (invalidate 
data cache) instruction and could be used to flush 
an external cache. The Write Back cycle is generat- 
ed when the Intel486 Microprocessor executes the 
WBINVD (write-back invalidate data cache) instruc- 
tion and could be used to synchronize an external 
write-back cache. 



The external hardware must acknowledge these 
special bus cycles by returning RDY# or BRDY#. 

Table 7.9. Special Bus Cycle Encoding 
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7.2.11.1 Halt Indication Cycle 

The Intel486 Microprocessor halts as a result of exe- 
cuting a HALT instruction. Signaling its entrance into 
the halt state, a halt indication cycle is performed. 
The halt indication cycle is identified by the bus defi- 
nition signals In special bus cycle state and a byte 
address of 2. BEO# and BE2# are the only signals 
distinguishing halt indication from shutdown Indica- 
tion, which drives an address of 0. During the halt 
cycle undefined data is driven on D0-D31. The halt 
indication cycle must be acknowledged by RDY# or 
BRDY# asserted. 
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Figure 7.28. Restarted Read Cycle 
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Figure 7.29. Restarted Write Cycle 



A halted Intel486 Microprocessor resumes execu- 
tion when INTR (if interrupts are enabled) or NMI or 
RESET is asserted. 



7.2.11.2 Sliutdown Indication Cycle 

The Intel486 Microprocessor shuts down as a result 
of a protection fault while attempting to process a 
double fault. Signaling its entrance into the shut- 
down state, a shutdown indication cycle is per- 
formed. The shutdown indication cycle is identified 
by the bus definition signals in special bus cycle 
state and a byte address of 0. 



7.2.12 BUS CYCLE RESTART 

In a multi-master system another bus master may 
require the use of the bus to enable the Intel486 
Microprocessor to complete its current bus request. 
In this situation the Intel486 Microprocessor will 
need to restart its bus cycle after the other bus mas- 
ter has completed its bus transaction. 

A bus cycle may be restarted if the external system 
asserts the backoff (BOFF#) input. The Intel486 Mi- 
croprocessor samples the BOFF# pin every clock. 
The Intel486 Microprocessor will immediately (in the 
next clock) float its address, data and status pins 
when BOFF# is asserted (see Figure 7.28). Any bus 
cycle in progress when BOFF# is asserted is abort- 



ed and any data returned to the processor is ig- 
nored. The same pins are floated in response to 
BOFF# as are floated in response to HOLD. HLDA 
Is not generated in response to BOFF#. BOFF# 
has higher priority than RDY# or BRDY#. If either 
RDY# or BRDY# are returned in the same clock as 
BOFF#, BOFF# takes effect. 

The device asserting BOFF# Is free to run any cy- 
cles it wants while the Intel486 Microprocessor bus 
is in its high Impedance state. If backoff is requested 
after the Intel486 Microprocessor has started a cy- 
cle, the new master should wait for memory to return 
RDY# or BRDY# before assuming control of the 
bus. Waiting for ready provides a handshake to in- 
sure that the memory system is ready to accept a 
new cycle. If the bus is idle when BOFF# Is assert- 
ed, the new master can start its cycle two clocks 
after issuing BOFF#. 

The external memory can view BOFF# in the same 
manner as BLAST#. Asserting BOFF# tells the ex- 
ternal memory system that the current cycle is the 
last cycle in a transfer. 

The bus remains in the high impedance state until 
BOFF# Is negated. Upon negation, the Intel486 Mi- 
croprocessor restarts its bus cycle by driving out the 
address and status and asserting ADS#. The bus 
cycle then continues as usual. 
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Asserting BOFF# during a burst, BS8# or BS16# 
cycle will force the Intel486 Microprocessor to ig- 
nore data returned for that cycle only. Data from pre- 
vious cycles will still be valid. For example, if 
BOFF# is asserted on the third BRDY# of a burst, 
the Intel486 Microprocessor assumes the data re- 
turned with the first and second BRDY#'s is correct 
and restarts the burst beginning with the third item. 
The same rule applies to transfers broken into multi- 
ple cycle by BS8# or BS16#. 

Asserting BOFF# in the same clock as ADS# will 
cause the Intel486 Microprocessor to float its bus in 
the next clock and leave ADS# floating low. Since 
ADS# is floating low, a peripheral may think that a 
new bus cycle has begun even-though the cycle was 



aborted. There are two possible solutions to this 
problem. The first is to have all devices recognize 
this condition and ignore ADS# until ready comes 
back. The second approach is to use a "two clock" 
backoff: in the first clock AHOLD is asserted, and in 
the second clock BOFF# is asserted. This guaran- 
tees that ADS# will not be floating low. This is only 
necessary in systems where BOFF# may be assert- 
ed in the same clock as ADS#. 

7.2.13 BUS STATES 

A bus state diagram is shown in Figure 7.30. A de- 
scription of the signals used in the diagram is given 
in Table 7.10. 



(RDY# ASSERTED ■ 



(BRDY# . BLAST#)ASSERTED) • 
(HOLD + AHOLD + NO REQUEST) . 
BOFF# NEGATED 





REQUEST PENDING • 
(RDY# ASSERTED + (BRDY# • BLAST#)ASSERTED) • 
HOLD NEGATED • 
AHOLD NEGATED • 
B0FF# NEGATED • 

REQUEST PENDING • 

HOLD NEGATED • 

AHOLD NEGATED • 
BOFF# NEGATED 



AHOLD NEGATED • 
B0FF# NEGATED • 
(HOLD NEGATED *) 

• HOLD Is only factored into this state transition if \ was entered while a 
non-cacheable, non-burstod, code prefetch was in progress. 
Otherwise, ignore HOLD. 
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Figure 7.30. Bus State Diagram 



Table 7.10. Bus State Description 



State 


Means 


Ti 


Bus is idle. Address and status signals may be driven to undefined values, or 
the bus may be floated to a high impedance state. 


T1 


First clock cycle of a bus cycle. Valid address and status are driven and 
ADS# is asserted. 


T2 


Second and subsequent clock cycles of a bus cycle. Data is driven if the 
cycle is a write, or data is expected if the cycle is a read. RDY# and BRDY# 
are sampled. 


T1b 


First clock cycle of a restarted bus cycle. Valid address and status are driven 
and ADS# is asserted. 


Tb 


Second and subsequent clock cycles of an aborted bus cycle. 
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7.2.14 FLOATING POINT ERROR HANDLING 

The Intel486 Microprocessor provides two options 
for reporting floating point errors. The simplest 
method is to raise interrupt 16 whenever an un- 
masked floating point error occurs. This option may 
be enabled by setting the NE bit in control register 
(CRO). 

The Intel486 Microprocessor also provides the op- 
tion of allowing external hardware to determine how 
floating point errors are reported. This option is nec- 
essary for compatibility with the error reporting 
scheme used in DOS based systems. The NE bit 
must be cleared in CRO to enable user-defined error 
reporting. User-defined error reporting is the default 
condition because the NE bit is cleared on reset. 

Two pins, floating point error (FERR#) and ignore 
numeric error (IGNNE#), are provided to direct the 
actions of hardware if user-defined error reporting is 
used. The Intel486 Microprocessor asserts the 
FERR# output to indicate that a floating point error 
has occurred. FERR# corresponds to the ERROR # 
pin on the 387 math coprocessor. However, there is 
a difference in the behavior of the two. 

In some cases FERR# is asserted when the next 
floating point instruction is encountered and in other 
cases it is asserted before the next floating point 
instruction is encountered depending upon the exe- 
cution state of the instruction causing the exception. 

The following class of floating point exceptions drive 
FERR# at the time the exception occurs (i.e., before 
encountering the next floating point instruction). 

1. The stack fault, invalid operation, and denormal 
exceptions on all transcendental instructions, in- 
teger arithmetic instructions, FSQRT, FSEALE, 
FPREM(1), EXTRACT, FBLD, and FBSTP. 

2. Any exceptions on store instructions (including 
integer store instructions). 

The following class of floating point exceptions drive 
FERR# only after encountering the next floating 
point instruction. 

1. Exceptions other than on all transcendental in- 
structions, integer arithmetic instructions, 
FSQRT, FSCALE, FPREM(1), EXTRACT. FBLD, 
and FBSTP. 

2. Any exception on all basic arithmetic, load, com- 
pare, and control instructions (i.e., all other in- 
structions). 

For both sets of exceptions above, the 387 Math 
Coprocessor asserts ERROR # when the error oc- 
curs and does not wait for the next floating point 
instruction to be encountered. 



When the NE bit in CRO is cleared, and IGNNE# is 
asserted, the Intel486 Microprocessor will ignore a 
user floating point error and continue executing 
floating point instructions. When IGNNE# Is negat- 
ed, the Intel486 Microprocessor will freeze on float- 
ing point instructions which get errors (except for the 
control instructions FNCLEX, FNINIT, FNSAVE, 
FNSTENV, FNSTCW, FNSTSW, FNSTSW AX, FNE- 
Nl, FNDISI and FNSETPM). IGNNE# may be asyn- 
chronous to the Intel486 clock. 

In systems with user-defined error reporting, the 
FERR# pin is connected to the Interrupt controller. 
When an unmasked floating point error occurs, an 
interrupt is raised. If IGNNE# is high at the time of 
this interrupt, the Intel486 Microprocessor will freeze 
(disallowing execution of a subsequent floating point 
instruction) until the interrupt handler is invoked. By 
driving the IGNNE# pin low (when clearing the Inter- 
rupt request), the interrupt handler can allow execu- 
tion of a floating point instruction, within the interrupt 
handler, before the error condition is cleared (by 
FNCLEX, FNINIT, FNSAVE or FNSTENV). If execu- 
tion of a non-control floating point instruction, within 
the floating point interrupt handler, is not needed, 
the IGNNE# pin can be tied HIGH. 

7.2.15 FLOATING POINT ERROR HANDLING IN 
AT COMPATIBLE SYSTEMS 

The Intel486 DX Microprocessor provides special 
features to allow the implementation of an AT com- 
patible numerics error reporting scheme. These fea- 
tures DO NOT replace the external circuit. Logic is 
still required that decodes the OUT FO instruction 
and latches the FERR# signal. What follows is a 
description of the use of these Intel486 DX Micro- 
processor features. 

The features provided by the Intel486 DX Microproc- 
essor are the NE bit in the Machine Status Register, 
the IGNNE# pin, and the FERR# pin. 

The NE bit determines the action taken by the In- 
tel486 DX Microprocessor when a numerics error is 
detected. When set this bit signals that non-DOS 
compatible error handling will be implemented. In 
this mode the Intel486 DX Microprocessor takes a 
software exception (16) if a numerics error is detect- 
ed. 

If the NE bit is reset the Intel486 DX Microprocessor 
uses the IGNNE# pin to allow an external circuit to 
control the time at which non-control numerics in- 
structions are allowed to execute. Note that floating 
point control instructions such as FNINIT and 
FNSAVE can be executed during a floating point er- 
ror condition regardless of the state of IGNNE#. 



IGNNE# is an input to the Intel486 Microprocessor. 
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To process a floating point error in the DOS environ- 
ment the following sequence must take place: 

1 . The error is detected by the Intel486 DX Micro- 
processor which activates the FERR# pin. 

2. FERR# is latched so that It can be cleared by the 
OUT FO instruction. 

3. The latched FERR# signal activates an interrupt 
at the interrupt controller. This interrupt is usually 
handled on IRQ13. 

4. The Interrupt Service Routine (ISR) handles the 
error and then clears the interrupt by executing an 
OUT instruction to port FO. The address FO is de- 
coded externally to clear the FERR# latch. The 
IGNNE# signal is also activated by the decoder 
output. 

5. Usually the ISR then executes an FNINIT instruc- 
tion or other control instruction before restarting 
the program. FNINIT clears the FERR# output. 



Figure 7.31 illustrates the circuit required to perform 
this function. Note that this circuit has not been test- 
ed. It is included as an example of the required error 
handling logic. 

Note that the IGNNE# input allows non-control in- 
structions to be executed prior to the time the 
FERR# signal is reset by the Intel486 DX Micro- 
processor. This function is implemented to allow ex- 
act compatibility with the AT implementation. Most 
programs reinitialize the floating point unit before 
continuing after an error is detected. The floating 
point unit can be reinitialized using one of the follow- 
ing four instructions: FCLEX, FIN IT, FSAVE, 
FSTENV. 
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Figure 7.31. DOS Compatible Numerics Error Circuit 
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8.0 Intel486 CPU TESTABILITY 

Testing the Intel486 Microprocessor can be divided 
into three categories: Built-in Self Test (BIST), 
Boundary Scan, and external testing. BIST performs 
basic device testing on the Intel486 CPU, including 
the non-random logic, control ROM (CROM), trans- 
lation lookaside buffer (TLB), and on-chip cache 
memory. Boundary Scan provides additional test 
hooks that conform to the IEEE Standard Test Ac- 
cess Port and Boundary Scan Architecture (IEEE 
Std.1 149.1). The Intel486 Microprocessor also has a 
test mode in which all of its outputs are tristated. 
Additional testing can be performed by using the test 
registers within the Intel486 CPU. 

8.1 Built-in Self Test (BIST) 

The BIST is initiated by asserting AHOLD (address 
hold) on the falling edge of RESET. AHOLD is a 
synchronous signal only. It should be asserted in the 
clock prior to RESET going from High to Low to start 
BIST. FLUSH # must also be asserted (driven low) 
prior to the falling edge of RESET to start BIST. 
FLUSH # must be deasserted (driven high) during 
BIST. A20M# must be deasserted (driven high) dur- 
ing the falling edge of RESET to start BIST. The 
BIST takes approximately 2**20 clocks, or approxi- 
mately 42 milliseconds with a 25 MHz Intel486 mi- 
croprocessor. No bus cycles will be run by the In- 
tel486 Microprocessor until the BIST is concluded. 
Note that for the Intel486 Microprocessor the RE- 
SET must be active for 15 clocks with or without 
BIST being enabled for warm resets. 

The results of BIST is stored in the EAX register. 
The Intel486 Microprocessor has successfully- 
passed the BIST if the contents of the EAX register 
are zero. If the results in EAX are not zero then the 
BIST has detected a flaw in the microprocessor. The 



microprocessor performs reset and begins normal 
operation at the completion of the BIST. 

The non-random logic, control ROM, on-chip cache 
and translation lookaside buffer (TLB) are tested 
during the BIST. 

The cache portion of the BIST verifies that the 
cache is functional and that it is possible to read and 
write to the cache. The BIST manipulates test regis- 
ters TR3, TR4 and TR5 while testing the cache. 
These test registers are described in Section 8.2. 

The cache testing algorithm writes a value to each 
cache entry, reads the value back, and checks that 
the correct value was read back. The algorithm may 
be repeated more than once for each of the 512 
cache entries using different constants. 

The TLB portion of the BIST verifies that the TLB is 
functional and that it is possible to read and write to 
the TLB. The BIST manipulates test registers TR6 
and TR7 while testing the TLB. TR6 and TR7 are 
described in Section 8.3. 



8.2 On-Chip Cache Testing 

The on-chip cache testability hooks are designed to 
be accessible during the BIST and for assembly lan- 
guage testing of the cache. 

The Intel486 Microprocessor contains a cache fill 
buffer and a cache read buffer. For testability writes, 
data must be written to the cache fill buffer before it 
can be written to a location in the cache. Data must 
be read from a cache location into the cache read 
buffer before the microprocessor can access the 
data. The cache fill and cache read buffer are both 
128 bits wide. 



11 10 9 8 7 
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(used only 
during reads) 


(used only 
during reads) 





TR3 

Cache Data 
Test Register 



TR4 

Cache Status 

Test Register 



4 3 2 10 





Set Select 


Entry 
Select 


Control 



TR5 

Cache Control 

Test Register 



ii = unused 



Figure 8.1. Cache Test Registers 
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8.2.1 CACHE TESTING REGISTERS TR3, TR4 
AND TR5 

Figure 8.1 shows the three cache testing registers: 
the Cache Data Test Register (TR3), the Cache 
Status Test Register (TR4) and the Cache Control 
Test Register (TR5). External access to these regis- 
ters is provided through MOV reg,TREG and MOV 
TREG, reg instructions. 

Cache Data Test Register: TR3 

The cache fill buffer and the cache read buffer can 
only be accessed through TR3. Data to be written to 
the cache fill buffer must first be written to TR3. Data 
read from the cache read buffer must be loaded into 
TR3. 

TR3 is 32 bits wide while the cache fill and read 
buffers are 128 bits wide. 32 bits of data must be 
written to TR3 four times to fill the cache fill buffer. 
32 bits of data must be read from TR3 four times to 
empty the cache read buffer. The entry select bits in 
TR5 determine which 32 bits of data TR3 will access 
in the buffers. 

Cache Status Test Register: TR4 

TR4 handles tag, LRU and valid bit information dur- 
ing cache tests. TR4 must be loaded with a tag and 
a valid bit before a write to the cache. After a read 
from a cache entry, TR4 contains the tag and valid 
bit from that entry, and the LRU bits and four valid 
bits from the accessed set. 

Cache Controi Test Register: TR5 

TR5 specifies which testability operation will be per- 
formed and the set and entry within the set which 
will be accessed. 



The seven bit set select field determines which of 
the 128 sets will be accessed. 

The functionality of the two entry select bits depend 
on the state of the control bits. When the fill or read 
buffers are being accessed, the entry select bits 
point to the 32-bit location in the buffer being ac- 
cessed. When a cache location is specified, the en- 
try select bits point to one of the four entries in a set. 
Refer to Table 8.1. 

Five testability functions can be performed on the 
cache. The two control bits in TR5 specify the oper- 
ation to be executed. The five operations are: 

1 . Write cache fill buffer 

2. Perform a cache testability write 

3. Perform a cache testability read 

4. Read the cache read buffer 

5. Perform a cache flush 

Table 8.1 shows the encoding of the two control bits 
in TR5 for the cache testability functions. Table 8.1 
also shows the functionality of the entry and set se- 
lect bits for each control operation. 

The cache tests attempt to use as much of the nor- 
mal operating circuitry as possible. Therefore when 
cache tests are being performed, the cache must be 
disabled (the CD and NW bits in control register 
must be set to 1 to disable the cache. See Section 
5). 

8.2.2 CACHE TESTABILITY WRITE 

A testability write to the cache is a two step process. 
First the cache fill buffer must be loaded with 128 
bits of data and TR4 loaded with the tag and valid 
bit. Next the contents of the fill buffer are written to a 
cache location. Sample assembly code to do a write 
is given in Figure 8.2. 



Table 8.1. Cache Control Bit Encoding and Effect of 
Control Bits on Entry Select and Set Select Functionality 



Control Bits 


Operation 


Entry Select Bits 
Function 


Set Select Bits 


Biti 


BitO 








r Fill Buffer Write 
bnaoie | Read Buffer Read 


Select 32-blt location in fill/read 
buffer 


— 





1 


Perform Cache Write 


Select an entry in set. 


Select a set to write to 


1 





Perform Cache Read 


Select an entry in set. 


Select a set to read from 


1 


1 


Perform Flush Cache 


— 


— 
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Sample Assembly Code 




An example assembly language sequence to perform a cache write is: 






eax. ebx. ecx. edx contain the cache line to write 






edi contains the tag information to load 






CRO already says to enable reads/write to TR5 






fill the cache buffer 




mov esi,0 ; set up command 




mov tr5,esi ; load to TR5 




mov tr3,eax ; load data into cache fill 


buffer 


mov esi,4 




mov tr5,esi 




mov tr3,ebx 




mov esi,8 




mov tr5,esi 




mov tr3,ecx 




mov esi,Och 




mov tr5,esi 




mov tr3,edx 






load the Cache Status Register 




» 

mov tr4,edi ; load 21-bit tag and valid 


bit 




perform the cache write 




mov esi,l 




mov tr5,esi ; write the cache (set 0, entry 0) 


An example assembly language sequence to perform a cache read is: 






data into eax, ebx, ecx, edx; status into edi 






read the cache line back 




mov esi,2 




mov tr5,esi ; do cache testability read 


(set 0, entry 0) 




read the data from the read buffer 




» 

mov esi,0 




mov tr5,esi 




mov eax,tr3 




mov esi,4 




mov tr5,esi 




mov ebx,tr3 




mov esi,8 




mov tr5,esi 




mov ecx,tr3 




mov esijOch 




mov tr5,esi 




mov edx,tr3 






; read the status from TR4 




» 

mov edi,tr4 





Figure 8.2 Sample Assembly Code for Cache Testing 
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Loading the fill buffer is accomplished by first writing 
to the entry select bits in TR5 and setting the control 
bits in TR5 to 00. The entry select bits identify one of 
four 32-bit locations in the cache fill buffer to put 32 
bits of data. Following the write to TR5, TR3 is writ- 
ten with 32 bits of data which are immediately 
placed in the cache fill buffer. Writing to TR3 initiates 
the write to the cache fill buffer. The cache fill buffer 
is loaded with 128 bits of data by writing to TR5 and 
TR3 four times using a different entry select location 
each time. 

TR4 must be loaded with the 21 -bit tag and valid bit 
(bit 10 in TR4) before the contents of the fill buffer 
are written to a cache location. 

The contents of the cache fill buffer are written to a 
cache location by writing TR5 with a control field of 
01 along with the set select and entry select fields. 
The set select and entry select field indicate the lo- 
cation in the cache to be written. The normal cache 
LRU update circuitry updates the internal LRU bits 
for the selected set. 

Note that a cache testability write can only be done 
when the cache is disabled for replaces (the CD bit 
is control register is reset to 1). Also note that care 
must be taken when directly writing to entries in the 
cache. If the entry is set to overlap an area of mem- 
ory that is being used in external memory, that 
cache entry could inadvertently be used instead of 
the external memory. Of course, this is exactly the 
type of operation that one would desire if the cache 
were to be used as a high speed RAM. 

8.2.3 CACHE TESTABILITY READ 

A cache testability read is a two step process. First 
the contents of the cache location are read into the 
cache read buffer. Next the data is examined by 
reading it out of the read buffer. Sample assembly 
code to do a testability read is given in Figure 8.2. 

Reading the contents of a cache location into the 
cache read buffer is initiated by writing TR5 with the 
control bits set to 1 and the desired seven-bit set 
select and two-bit entry select. In response to the 
write to TR5, TR4 is loaded with the 21 -bit tag field 
and the single valid bit from the cache entry read. 
TR4 is also loaded with the three LRU bits and four 
valid bits corresponding to the cache set that was 
accessed. The cache read buffer is filled with the 
128-bit value which was found in the data array at 
the specified location. 

The contents of the read buffer are examined by 
performing four reads of TR3. Before reading TR3 
the entry select bits in TR5 must loaded to indicate 
which of the four 32-bit words in the read buffer to 



transfer into TR3 and the control bits in TR5 must be 
loaded with 00. The register read of TR3 will initiate 
the transfer of the 32-bit value from the read buffer 
to the specified general purpose register. 

Note that it is very important that the entire 1 28-bit 
quantity from the read buffer and also the informa- 
tion from TR4 be read before any memory refer- 
ences are allowed to occur. If memory operations 
are allowed to happen, the contents of the read buff- 
er will be corrupted. This is because the testability 
operations use hardware that is used in normal 
memory accesses for the Intel486 microprocessor 
whether the cache is enabled or not. 



8.2.4 FLUSH CACHE 

The control bits in TR5 must be written with 1 1 to 
flush the cache. None of the other bits in TR5 have 
any meaning when 1 1 is written to the control bits. 
Flushing the cache will reset the LRU bits and the 
valid bits to 0, but will not change the cache tag or 
data arrays. 

When the cache is flushed by writing to TR5 the 
special bus cycle Indicating a cache flush to the ex- 
ternal system is not run (see Section 7.2.1 1, Special 
Bus Cycles). The cache should be flushed with the 
instruction INVD (Invalidate Data Cache) instruction 
or the WBINVD (Write-back and Invalidate Data 
Cache) instruction. 



8.3 Translation Lookaside Buffer 
(TLB) Testing 

The Intel486 Microprocessor TLB testability hooks 
are similar to those in the 386 Microprocessor. The 
testability hooks have been enhanced to provide 
added test features and to include new features in 
the Intel486 Microprocessor. The TLB testability 
hooks are designed to be accessible during the 
BIST and for assembly language testing of the TLB. 

8.3.1 TRANSLATION LOOKASIDE BUFFER 
ORGANIZATION 

The Intel486 Microprocessors TLB is 4-way set as- 
sociative and has space for 32 entries. The TLB is 
logically split into three blocks shown in Figure 8.3. 

The data block is physically split into four arrays, 
each with space for eight entries. An entry in the 
data block is 22 bits wide containing a 20-bit physi- 
cal address and two bits for the page attributes. The 
page attributes are the PCD (page cache disable) bit 
and the PWT (page write-through) bit. Refer to Sec- 
tion 4.5.4 for a discussion of the PCD and PWT bits. 
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Figure 8.3. TLB Organization 



The tag block is also split into four arrays, one for 
each of the data arrays. A tag entry is 21 bits wide 
containing a 17-bit linear address and four protec- 
tion bits. The protection bits are valid (V), user/su- 
pervisor (U/S), read/write (R/W) and dirty (D). 

The third block contains eight three bit quantities 
used in the pseudo least recently used (LRU) re- 
placement algorithm. These bits are called the LRU 
bits. The LRU replacement algorithm used in the 



TLB is the same as used by the on-chip cache. For a 
description of this algorithm refer to Section 5.5. 

8.3.2 TLB TEST REGISTERS TR6 AND TR7 

The two TLB test registers are shown in Figure 8.4. 
TR6 is the command test register and TR7 is the 
data test register. External access to these registers 
is provided through MOV reg.TREG and MOV 
TREG.reg instructions. 
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Command Test Register: TR6 

TR6 contains the tag information and control infor- 
mation used in a TLB test. Loading TR6 with tag and 
control information initiates a TLB write or lookup 
test. 

TR6 contains three bit fields, a 20-bit linear address 
(bits 12-31), seven bits for the TLB tag protection 
bits (bits 5-11) and one bit (bit 0) to define the type 
of operation to be performed on the TLB. 

The 20-blt linear address forms the tag information 
used in the TLB access. The lower three bits of the 
linear address select which of the eight sets are ac- 
cessed. The upper 17 bits of the linear address form 
the tag stored in the tag array. 

The seven TLB tag protection bits are described be- 
low. 

V: The valid bit for this TLB entry 

D,D#: The dirty bit for/from the TLB entry 

U,U#: The user/supervisor bit for/from the TLB 
entry 

W,W#: The read/write bit for/from the TLB entry 

Two bits are used to represent the D, U/S and R/W 
bits in the TLB tag to permit the option of a forced 
miss or hit during a TLB lookup operation. The 
forced miss or hit will occur regardless of the state 
of the actual bit in the TLB. The meaning of these 
pairs of bits is given in Table 8.2. 

The operation bit in TR6 determines if the TLB test 
operation will be a write or a lookup. The function of 
the operation bit is given in Table 8.3. 

Table 8.3. TR6 Operation Bit Encoding 



TR6 
BitO 


TLB Operation 
to Be Performed 




1 


TLB Write 
TLB Lookup 



Data Test Register: TR7 

TR7 contains the information stored or read from the 
data block during a TLB test operation. Before a TLB 



test write, TR7 contains the physical address and 
the page attribute bits to be stored in the entry. After 
a TLB test lookup hit, TR7 contains the physical ad- 
dress, page attributes, LRU bits and entry location 
from the access. 

TR7 contains a 20-bit physical address (bits 12-31), 
two bits for PCD (bit 1 1) and PWT (bit 10) and three 
bits for the LRU bits (bits 7-9). The LRU bits in TR7 
are only used during a TLB lookup test. The func- 
tionality of TR7 bit 4 differs for TLB writes and look- 
ups. The encoding of bit 4 Is defined in Tables 8.4 
and 8.5. Finally TR7 contains two bits (bits 2-3) to 
specify a TLB replacement pointer or the location of 
a TLB hit. 

Table 8.4. Encoding of Bit 4 of TR7 on Writes 



TR7 
Bit 4 


Replacement Pointer 
Used on TLB Write 




1 


Pseudo-LRU Replacement Pointer 
Data Test Register Bits 3:2 


Table 8.5. Encoding of Bit 4 of TR7 on Lookups 


TR7 
Bit 4 


Meaning after TLB 
Lookup Operation 




1 


TLB Lookup Resulted in a Miss 
TLB Lookup Resulted in a Hit 



A replacement pointer is used during a TLB write. 
The pointer indicates which of the four entries In an 
accessed set is to be written. The replacement 
pointer can be specified to be the internal LRU bits 
or bits 2-3 in TR7. The source of the replacement 
pointer is specified by TR7 bit 4. The encoding of bit 
4 during a write is given by Table 8.4. 

Note that both testability writes and lookups affect 
the state of the internal LRU bits regardless of the 
replacement pointer used. All TLB write operations 
(testability or normal operation) cause the written 
entry to become the most recently used. For exam- 
ple, during a testability write with the replacement 
pointer specified by TR7 bits 2-3, the indicated en- 
try is written and that entry becomes the most re- 
cently used as specified by the internal LRU bits. 



Table 8.2. Meaning of a Pair of TR6 Protection Bits 



TR6 Protection Bit 
(B) 


TR6 Protection Bit# 
(B#) 


Meaning on 
TLB Write Operation 


Meaning on 
TLB Lookup Operation 




1 
1 



1 

1 


Undefined 

Write to TLB TAG Bit B 

Write 1 to TLB TAG Bit B 

Undefined 


Miss any TLB TAG Bit B 
Match TLB TAG Bit B if 
Match TLB TAG Bit B if 1 
Match anyTLB TAG Bit B 
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There are two TLB testing operations: write entries 
into the TLB, and perform TLB lookups. One major 
enhancement over TLB testing in the 386 Micro- 
processor is that paging need not be disabled while 
executing testability writes or lookups. 

Note that any time one TLB set contains the same 
linear address in more than one of its entries, look- 
ing up that linear address will not result in a hit. 
Therefore a single linear address should not be writ- 
ten to one TLB set more than once. 



Bits 9-7 will contain the LRU bits associated with 
the accessed set. The state of the LRU bits is previ- 
ous to their being updated for the current lookup. 

If bit 4 in TR7 indicated that the lookup test resulted 
in a miss the remaining bits in TR7 are undefined. 

Again it should be noted that a TLB testability lookup 
operation affects the state of the LRU bits. The LRU 
bits will be updated if a hit occurred. The entry which 
was hit will become the most recently used. 



8.3.3 TLB WRITE TEST 

To perform a TLB write TR7 must be loaded fol- 
lowed by a TR6 load. The register operations must 
be performed in this order since the TLB operation is 
triggered by the write to TR6. 

TR7 is loaded with a 20-bit physical address and 
values for PCD and PWT to be written to the data 
portion of the TLB. In addition, bit 4 of TR7 must be 
loaded to indicate whether to use TR7 bits 3-2 or the 
internal LRU bits as the replacement pointer on the 
TLB write operation. Note that the LRU bits in TR7 
are not used in a write test. 

TR6 must be written to initiate the TLB write opera- 
tion. Bit in TR6 must be reset to zero to indicate a 
TLB write. The 20-bit linear address and the seven 
page protection bits must also be written in TR6 to 
specify the tag portion of the TLB entry. Note that 
the three least significant bits of the linear address 
specify which of the eight sets in the data block will 
be loaded with the physical address data. Thus only 
1 7 of the linear address bits are stored in the tag 
array. 

8.3.4 TLB LOOKUP TEST 

To perform a TLB lookup it Is only necessary to write 
the proper tags and control information into TR6. Bit 
in TR6 must be set to 1 to indicate a TLB lookup. 
TR6 must be loaded with a 20-blt linear address and 
the seven protection bits. To force misses and 
matches of the individual protection bits on TLB 
lookups, set the seven protection bits as specified in 
Table 8.2. 

A TLB lookup operation is initiated by the write to 
TR6. TR7 will indicate the result of the lookup opera- 
tion following the write to TR6. The hit/miss indica- 
tion can be found in TR7 bit 4 (see Table 8.5). 

TR7 will contain the following information if bit 4 indi- 
cated that the lookup test resulted in a hit. Bits 2-3 
will indicate in which set the match occurred. The 22 
most significant bits in TR7 will contain the physical 
address and page attributes contained in the entry. 



8.4 Tristate Output Test Mode 

The Intel486 Microprocessor provides the ability to 
float all its outputs and bidirectional pins. This in- 
cludes all pins floated during bus hold as well as 
pins which are never floated in normal operation of 
the chip (HLDA, BREQ, FERR# and PCHK#). 
When the Intel486 microprocessor is in the tri-state 
output test mode external testing can be used to test 
board connections. 

The tri-state test mode is invoked by driving 
FLUSH # low for 2 clocks before and 2 clocks after 
RESET going low. The outputs are guaranteed to tri- 
state no later than 10 clocks after RESET goes low 
(see Figure 6.4). The Intel486 Microprocessor re- 
mains in the tristate test mode until the next RESET. 



8.5 Intel486™ Microprocessor 
Boundary Scan (JTAG) 

The Intel486 Microprocessor (50 MHz version only) 
provides additional testability features compatible 
with the IEEE Standard Test Access Port and 
Boundary Scan Architecture (IEEE Std.1149.1). The 
test logic provided allows for testing to insure that 
components function correctly, that interconnec- 
tions between various components are correct, and 
that various components interact correctly on the 
printed circuit board. 

The boundary scan test logic consists of a boundary 
scan register and support logic that are accessed 
through a test access port (TAP). The TAP provides 
a simple serial interface that makes it possible to 
test all signal traces with only a few probes. 

The TAP can be controlled via a bus master. The 
bus master can be either automatic test equipment 
or a component (PLD) that interfaces to the four-pin 
test bus. 
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8.5.1 BOUNDARY SCAN ARCHITECTURE 

The boundary scan test logic contains the following 
elements: 

— Test access port (TAP), consisting of input pins 
TMS, TCK, and TDI; and output pin TDO. 

— TAP controller, which interprets the Inputs on the 
test mode select (TMS) line and performs the 
corresponding operation. The operations per- 
formed by the TAP include controlling the in- 
struction and data registers within the compo- 
nent. 

— Instruction register (IR), which accepts Instruc- 
tion codes shifted into the test logic on the test 
data input (TDI) pin. The instruction codes are 
used to select the specific test operation to be 
performed or the test data register to be ac- 
cessed. 

— Test data registers: The Intel486 Microprocessor 
contains three test data registers: Bypass regis- 
ter (BPR), Device Identification register (DID), 
and Boundary Scan register (BSR). 

The instruction and test data registers are separate 
shift-register paths connected in parallel and have a 
common serial data input and a common serial data 
output connected to the TAP signals, TDI and TDO, 
respectively. 

8.5.2 DATA REGISTERS 

The Intel486 CPU contains the two required test 
data registers; bypass register and boundary scan 
register. In addition, they also have a device identifi- 
cation register. 



Each test data register is serially connected to TDI 
and TDO, with TDI connected to the most significant 
bit and TDO connected to the least significant bit of 
the test data register. Data is shifted one stage (bit 
position within the register) on each rising edge of 
the test clock (TCK). 

In addition the Intel486 CPU contains a runbist regis- 
ter to support the RUNBIST boundary scan instruc- 
tion. 



8.5.2.1 Bypass Register 

The Bypass Register is a one-bit shift register that 
provides the minimal length path between TDI and 
TDO. This path can be selected when no test opera- 
tion is being performed by the component to allow 
rapid movement of test data to and from other com- 
ponents on the board. While the bypass register is 
selected, data is transferred from TDI to TDO with- 
out inversion. 



8.5.2.2 Boundary Scan Register 

The Boundary Scan Register Is a single shift register 
path containing the boundary scan cells that are 
connected to all input and output pins of the Intel486 
CPU. Figure 8.1 shows the logical structure of the 
boundary scan register. While output cells determine 
the value of the signal driven on the corresponding 
pin, input cells only capture data; they do not affect 
the normal operation of the device. Data is trans- 
ferred without inversion from TDI to TDO through the 
boundary scan register during scanning. The bound- 
ary scan register can be operated by the EXTEST 
and SAMPLE Instructions. The boundary scan regis- 
ter order is described in Section 8.5.5. 
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Figure 8.1. Logical Structure of Boundary Scan Register 
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8.5.2.3 Device Identification Register 

The Device Identification Register contains the man- 
ufacturer's identification code, part number code, 
and version code in the format shown in Figure 8.2. 
Table 8.1 lists the codes corresponding to the In- 
tel486 CPU. 



8.5.2.4 Runbist Register 

The Runbist Register is a one bit register used to 
report the results of the Intel486 CPU BIST when it 
is initiated by the RUNBIST instruction. This register 
is loaded with a "1 " prior to invoking the BIST and is 
loaded with "0" upon successful completion. 



8.5.3 INSTRUCTION REGISTER 

The Instruction Register (IR) allows instructions to 
be serially shifted into the device. The instruction 
selects the particular test to be performed, the test 
data register to be accessed, or both. The instruc- 



tion register is four (4) bits wide. The most significant 
bit is connected to TDI and the least significant bit is 
connected to TDO. There are no parity bits associat- 
ed with the Instruction register. Upon entering the 
Capture-IR TAP controller state, the Instruction reg- 
ister is loaded with the default instruction "0001", 
SAMPLE/PRELOAD. Instructions are shifted into 
the instruction register on the rising edge of TCK 
while the TAP controller is in the Shift-IR state. 



8.5.3.1 Intel486 CPU Boundary Scan 
Instruction Set 

The Intel486 CPU supports all three mandatory 
boundary scan instructions (BYPASS, SAMPLE/ 
PRELOAD, and EXTEST) along with two optional in- 
structions (IDCODE and RUNBIST). Table 8.2 lists 
the Intel486 CPU boundary scan instruction codes. 
The instructions listed as PRIVATE cause TDO to 
become enabled in the Shift-DR state and cause 
"0" to be shifted out of TDO on the rising edge of 
TCK. Execution of the PRIVATE instructions will not 
cause hazardous operation of the Intel486 CPU. 
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Figure 8.2. Format of Device Identification Register 
Table 8.1 



Component Code 


Version Code 


Part Number Code 


IVIanufacturer Identity 


Intel486 CPU (Ax) 


OOh 


041 Oh 


09h 


Intel486 CPU (Bx) 


OOh 


0411 h 


09h 
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Table 8.2 


Instruction Code 


Instruction Name 


0000 


EXTEST 


0001 


SAMPLE 


0010 


IDCODE 


0011 


PRIVATE 


0100 


PRIVATE 


0101 


PRIVATE 


0110 


PRIVATE 


0111 


PRIVATE 


1000 


RUNBIST 


1001 


PRIVATE 


1010 


PRIVATE 


1011 


PRIVATE 


1100 


PRIVATE 


1101 


PRIVATE 


1110 


PRIVATE 


1111 


BYPASS 



EXTEST The instruction code is "0000". The EX- 
TEST instruction allows testing of cir- 
cuitry external to the component pack- 
age, typically board interconnects. It 
does so by driving the values loaded 
into the Intel486 CPU's boundary scan 
register out on the output pins corre- 
sponding to each boundary scan cell 
and capturing the values on Intel486 
CPU input pins to be loaded Into their 
corresponding boundary scan register 
locations. I/O pins are selected as input 
or output, depending on the value load- 
ed into their control setting locations in 
the boundary scan register. Values 
shifted into input latches in the bounda- 
ry scan register are never used by the 
internal logic of the Intel486 CPU. 

NOTE: 

After using the EXTEST instruction, the 
Intel486 CPU must be reset before nor- 
mal (non-boundary scan) use. 

SAMPLE/ The Instruction code is "0001". The 
PRELOAD SAMPLE/PRELOAD has two functions 
that it performs. When the TAP control- 
ler is in the Capture-DR state, the SAM- 
PLE/PRELOAD instruction allows a 
"snap-shot" of the normal operation of 



the component without interfering with 
that normal operation. The instruction 
causes boundary scan register cells as- 
sociated with outputs to sample the val- 
ue being driven by the Intel486 CPU. It 
causes the cells associated with inputs 
to sample the value being driven into 
the Intel486 CPU. On both outputs and 
inputs the sampling occurs on the rising 
edge of TCK. When the TAP controller 
is in the Update-DR state, the SAM- 
PLE/PRELOAD instruction preloads 
data to the device pins to be driven to 
the board by executing the EXTEST in- 
struction. Data is preloaded to the pins 
from the boundary scan register on the 
falling edge of TCK. 

IDCODE The Instruction code is "0010". The ID- 
CODE instruction selects the device 
identification register to be connected 
to TDI and TDO, allowing the device 
identification code to be shifted out of 
the device on TDO. Note that the de- 
vice identification register is not altered 
by data being shifted in on TDI. 

BYPASS The instruction code is "1111". The 
BYPASS instruction selects the bypass 
register to be connected to TDI or TDO, 
effectively bypassing the test logic on 
the Intel486 microprocessor by reduc- 
ing the shift length of the device to one 
bit. Note than an open circuit fault in the 
board level test data path will cause the 
bypass register to be selected following 
an instruction scan cycle due to the 
pull-up resistor on the TDI Input. This 
has been done to prevent any unwant- 
ed interference with the proper opera- 
tion of the system logic. 

RUNBIST The instruction code is "1000". The 
RUNBIST instruction selects the one (1) 
bit runbist register, loads a value of "1" 
into the runbist register, and connects it 
to TDO. It also initiates the built-in self 
test (BIST) feature of the Intel486 CPU, 
which is able to detect approximately 
60% of the stuck-at faults on the In- 
tel486 CPU. The Intel486 CPU AC/DC 
Specifications for Vcc and CLK must be 
met and reset must have been asserted 
at least once prior to executing the 
RUNBIST boundary scan instruction. 
After loading the RUNBIST instruction 
code in the instruction register, the TAP 
controller must be placed in the Run- 
Test/Idle state. BIST begins on the first 
rising edge of TCK after entering the 
Run-Test/ Idle state. The TAP con- 



139 



iny. 



Intel486™ DX MICROPROCESSOR 



l?[^i(LORi]OKlAI^Y 



troller must remain in the Run-Test/ Idle 
state until BIST is completed. It requires 
1.2 million clock (CLK) cycles to com- 
plete BIST and report the result to the 
runbist register. After completing the 1 .2 
million clock (CLK) cycles, the value in 
the runbist register should be shifted 
out on TDO during the Shift-DR state. A 
value of "0" being shifted out on TDO 
indicates BIST successfully completed. 
A value of "1" indicates a failure oc- 
curred. After executing the RUNBIST in- 
struction, the Intel486 CPU must be re- 
set prior to normal operation. 

8.5.4 TEST ACCESS PORT (TAP) 
CONTROLLER 

The TAP controller is a synchronous, finite state ma- 
chine. It controls the sequence of operations of the 
test logic. The TAP controller changes state only in 
response to the following events: 

1. a rising edge of TCK 

2. power-up. 



The value of the test mode state (TMS) input signal 
at a rising edge of TCK controls the sequence of the 
state changes. The state diagram for the TAP con- 
troller is shown in Figure 8.3. Test designers must 
consider the operation of the state machine in order 
to design the correct sequence of values to drive on 
TMS. 



8.5.4.1 Test-Logic-Reset State 

In this state, the test logic is disabled so that normal 
operation of the device can continue unhindered. 
This is achieved by initializing the instruction register 
such that the IDCODE instruction is loaded. No mat- 
ter what the original state of the controller, the con- 
troller enters Test-Logic-Reset state when the TMS 
input is held high (1) for at least five rising edges of 
TCK. The controller remains in this state while TMS 
is high. The TAP controller is also forced to enter 
this state at power-up. 

8.5.4.2 Run-Test/Idle State 

A controller state between scan operations. Once in 
this state, the controller remains In this state as long 






Figure 8.3. TAP Controller State Diagram 
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as TMS is held low. In devices supporting the 
RUNBIST instruction, the BIST is performed during 
this state and the result is reported in the runbist 
register. For instruction not causing functions to exe- 
cute during this state, no activity occurs in the test 
logic. The instruction register and all test data regis- 
ters retain their previous state. When TMS is high 
and a rising edge is applied to TCK, the controller 
moves to the Select-DR state. 



8.5.4.3 Select-DR-Scan State 

This is a temporary controller state. The test data 
register selected by the current instruction retains Its 
previous state. If TMS is held low and a rising edge 
is applied to TCK when in this state, the controller 
moves into the Capture-DR state, and a scan se- 
quence for the selected test data register is initiated. 
If TMS is held high and a rising edge is applied to 
TCK, the controller moves to the Select-IR-Scan 
state. 

The instruction does not change in this state. 



8.5.4.4 Capture-DR State 

In this state, the boundary scan register captures 
input pin data if the current instruction is EXTEST or 
SAMPLE/PRELOAD. The other test data registers, 
which do not have parallel input, are not changed. 

The instruction does not change In this state. 

When the TAP controller is in this state and a rising 
edge is applied to TCK, the controller enters the 
Exit1-DR state if TMS is high or the Shift-DR state if 
TMS is low. 



8.5.4.5 Shift-DR State 

In this controller state, the test data register con- 
nected between TDI and TDO as a result of the cur- 
rent instruction, shifts data one stage toward its seri- 
al output on each rising edge of TCK. 

The instruction does not change in this state. 

When the TAP controller is in this state and a rising 
edge is applied to TCK, the controller enters the 
Exlt1 -DR state if TMS is high or remains in the Shift- 
DR state if TMS is low. 



nates the scanning process. If TMS is held low and a 
rising edge is applied to TCK, the controller enters 
the Pause-DR state. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 

8.5.4.7 Pause-Dr State 

The pause state allows the test controller to tempo- 
rarily halt the shifting of data through the test data 
register in the serial path between TDI and TDO. An 
example of using this state could be to allow a tester 
to reload its pin memory from disk during application 
of a long test sequence. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 

The controller remains in this state as long as TMS 
is low. When TMS goes high and a rising edge is 
applied to TCK, the controller moves to the Exit2-DR 
state. 



8.5.4.8 Exit2-DR State 

This is a temporary state. While in this state, if TMS 
Is held high, a rising edge applied to TCK causes the 
controller to enter the Update-DR state, which termi- 
nates the scanning process. If TMS is held low and a 
rising edge Is applied to TCK, the controller enters 
the Shift-DR state. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 



8.5.4.9 Update-DR State 

The boundary scan register is provided with a 
latched parallel output to prevent changes at the 
parallel output while data is shifted in response to 
the EXTEST and SAMPLE/PRELOAD Instructions. 
When the TAP controller is in this state and the 
boundary scan register is selected, data Is latched 
onto the parallel output of this register from the shift- 
register path on the falling edge of TCK. The data 
held at the latched parallel output does not change 
other than in this state. 



8.5.4.6 Exitl-DR State 

This is a temporary state. While in this state, if TMS 
is held high, a rising edge applied to TCK causes the 
controller to enter the Update-DR state, which termi- 



All shift-register stages in test data register selected 
by the current instruction retains its previous value 
during this state. The Instruction does not change in 
this state. 



141 



intel» 



lntel486TM DX MICROPROCESSOR 



PI^KLfllJiflOMAI^V 



8.5.4.10 Select-IR-Scan State 

This is a temporary controller state. The test data 
register selected by the current instruction retains its 
previous state. If TMS is held low and a rising edge 
is applied to TCK when in this state, the controller 
moves into the Capture-IR state, and a scan se- 
quence for the instruction register is initiated. If TMS 
is held high and a rising edge is applied to TCK, the 
controller moves to the Test-Logic-Reset state. 

The instruction does not change in this state. 



8.5.4.11 Capture-IR State 

In this controller state the shift register contained in 
the instruction register loads the fixed value "0001" 
on the rising edge of TCK. 

The test data register selected by the current in- 
struction retains it previous value during this state. 
The instruction does not change in this state. 

When the controller is in this state and a rising edge 
is applied to TCK, the controller enters the Exitl-IR 
state if TMS is held high, or the Shift-IR state if TMS 
is held low. 



8.5.4.12 Shift-IR State 

In this state the shift register contained in the in- 
struction register is connected between TDI and 
TDO and shifts data one stage towards its serial out- 
put on each rising edge of TCK. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 

When the controller is in this state and a rising edge 
is applied to TCK, the controller enters the Exitl-IR 
state if TMS is held high, or remains in the Shift-IR 
state if TMS is held low. 



8.5.4.13 Exitl-IR State 

This is a temporary state. While in this state, if TMS 
is held high, a rising edge applied to TCK causes the 
controller to enter the Update-IR state, which termi- 
nates the scanning process. If TMS is held low and a 



rising edge is applied to TCK, the controller enters 
the Pause-IR state. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 

8.5.4.14 Pause-IR State 

The pause state allows the test controller to tempo- 
rarily halt the shifting of data through the instruction 
register. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 

The controller remains in this state as long as TMS 
is low. When TMS goes high and a rising edge is 
applied to TCK, the controller moves to the Exit2-IR 
state. 



8.5.4.15 Exit2-IR State 

This is a temporary state. While in this state, if TMS 
is held high, a rising edge applied to TCK causes the 
controller to enter the Update-IR state, which termi- 
nates the scanning process. If TMS is held low and a 
rising edge is applied to TCK, the controller enters 
the Shift-IR state. 

The test data register selected by the current in- 
struction retains its previous value during this state. 
The instruction does not change in this state. 



8.5.4.16 Update-IR State 

The instruction shifted into the instruction register is 
latched onto the parallel output from the shift-regis- 
ter path on the falling edge of TCK. Once the new 
instruction has been latched, it becomes the current 
instruction. 

Test data registers selected by the current instruc- 
tion retain the previous value. 



8.5.5 BOUNDARY SCAN REGISTER CELL 

The boundary scan register contains a cell for each 
pin, as well as cells for control of I/O and tristate 
pins. 
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The following is the bit order of the Intel486 CPU 
boundary scan register: (from left to right and top to 
bottom). 



TDI 



^WRCTL ABUSCTL BUSCTL MISCCTL 
ADS# BLAST# PLOCK# LOCK# PCHK# 
BRDY# BOFF# BS16# BS8# RDY# KEN# 
HOLD AHOLD CLK HLDA WR# BREQ BEO# 
BE1# BE2# BE3# MIO# DC# PWT PCD 
EADS# A20M# RESET FLUSH # INTR NMI 
FERR# IGNNE# D31 D30 D29 D28 D27 D26 
D25 D24 DP3 D23 D22 D21 D20 D19 D18 D17 
D16 DP2 D15 D14 D13 D12 D11 D10 D9 D8 
DP1 D7 D6 D5 D4 D3 D2 D1 DO DPO A31 A30 
A29 A28 A27 A26 A25 A24 A23 A22 A21 A20 
A19 A18 A17 A16 A15 A14 A13 A12 A11 A10 
A9 A8 A7 A6 RESERVED A5 A4 A3 
A2 -» TDO 



"RESERVED" corresponds to no connect "NC" sig- 
nals on the Intel486 CPU. 



All the *CTL cells are control cells that are used to 
select the direction of bidirectional pins or tristate 
output pins. If "1" is loaded Into the control cell 
(*CTL), the associated pin(s) are tristated or select- 
ed as input. The following lists the control cells and 
their corresponding pins. 

1. WRCTL controls the D31-0 and DP3-0 pins. 

2. ABUSCTLcontrolsthe A31-A2 pins. 

3. BUSCTL controls the ADS#, BLAST#, 
PLOCK#, LOCK#, WR#, BEO#, BE1#, BE2#, 
BE3#, MIO#, DC#, PWT, and PCD pins. 

4. MISCCTL controls the PCHK#, HLDA, BREQ, 
and FERR# pins. 

8.5.6 TAP CONTROLLER INITIALIZATION 

The TAP controller is automatically initialized when a 
device Is powered up. In addition, the TAP controller 
can be initialized by applying a high signal level on 
the TMS input for five TCK periods. 



8.5.7 BOUNDARY SCAN DESCRIPTION 
LANGUAGE (BSDL) 

Available through Intel. 
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9.0 DEBUGGING SUPPORT 

The Intel486 Microprocessor provides several fea- 
tures which simplify the debugging process. The 
three categories of on-chip debugging aids are: 

1) the code execution breakpoint opcode (OCCH), 

2) the single-step capability provided by the TF bit 
in the flag register, and 

3) the code and data breakpoint capability provided 
by the Debug Registers DRO-3, DR6, and DR7. 



9.1 Breakpoint Instruction 

A single-byte-opcode breakpoint instruction is avail- 
able for use by software debuggers. The breakpoint 
opcode is OCCH, and generates an exception 3 trap 
when executed. In typical use, a debugger program 
can "plant" the breakpoint instruction at all desired 
code execution breakpoints. The single-byte break- 
point opcode is an alias for the two-byte general 
software interrupt instruction, INT n, where n = 3. 
The only difference between INT 3 (OCCh) and INT n 
is that INT 3 Is never lOPL-sensitive but INT n is 
lOPL-sensitive in Protected Mode and Virtual 8086 
Mode. 



9.2 Single-Step Trap 

If the single-step flag (TF, bit 8) in the EFLAG regis- 
ter is found to be set at the end of an instruction, a 
single-step exception occurs. The single-step ex- 
ception is auto vectored to exception number 1 . Pre- 
cisely, exception 1 occurs as a trap after the instruc- 
tion following the instruction which set TF. In typical 
practice, a debugger sets the TF bit of a flag register 
image on the debugger's stack. It then typically 
transfers control to the user program and loads the 
flag image with a signal instruction, the IRET instruc- 
tion. The single-step trap occurs after executing one 
instruction of the user program. 

Since the exception 1 occurs as a trap (that is, it 
occurs after the instruction has already executed), 
the CS:EIP pushed onto the debugger's stack points 
to the next unexecuted instruction of the program 
being debugged. An exception 1 handler, merely by 
ending with an IRET instruction, can therefore effi- 
ciently support single-stepping through a user pro- 
gram. 



on-chip registers, an instruction execution break- 
point can be placed in ROM code or in code shared 
by several tasks, neither of which can be supported 
by the INT3 breakpoint opcode. 

The Intel486 Microprocessor contains six Debug 
Registers, providing the ability to specify up to four 
distinct breakpoints addresses, breakpoint control 
options, and read breakpoint status. Initially after re- 
set, breakpoints are in the disabled state. Therefore, 
no breakpoints will occur unless the debug registers 
are programmed. Breakpoints set up in the Debug 
Registers are autovectored to exception number 1 . 

9.3.1 LINEAR ADDRESS BREAKPOINT 
REGISTERS (DR0-DR3) 

Up to four breakpoint addresses can be specified by 
writing into Debug Registers DR0-DR3, shown in 
Figure 9.1. The breakpoint addresses specified are 
32-bit linear addresses. Intel486 Microprocessor 
hardware continuously compares the linear break- 
point addresses in DR0-DR3 with the linear ad- 
dresses generated by executing software (a linear 
address is the result of computing the effective ad- 
dress and adding the 32-bit segment base address). 
Note that if paging is not enabled the linear address 
equals the physical address. If paging is enabled, 
the linear address is translated to a physical 32-bit 
address by the on-chip paging unit. Regardless of 
whether paging is enabled or not, however, the 
breakpoint registers hold linear addresses. 

9.3.2 DEBUG CONTROL REGISTER (DR7) 

A Debug Control Register, DR7 shown in Figure 9.1, 
allows several debug control functions such as en- 
abling the breakpoints and setting up other control 
options for the breakpoints. The fields within the De- 
bug Control Register, DR7, are as follows: 

LENi (breakpoint length specification bits) 

A 2-bit LEN field exists for each of the four break- 
points. LEN specifies the length of the associated 
breakpoint field. The choices for data breakpoints 
are: 1 byte, 2 bytes, and 4 bytes. Instruction execu- 
tion breakpoints must have a length of 1 (LENI = 
00). Encoding of the LENi field Is as follows: 



9.3 Debug Registers 

The Debug Registers are an advanced debugging 
feature of the Intel486 Microprocessor. They allow 
data access breakpoints as well as code execution 
breakpoints. Since the breakpoints are indicated by 
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31 16 15 


DRO 
DR1 
DR2 
DR3 
DR4 
DR5 

DR6 
DR7 




BREAKPOINT LINEAR ADDRESS 


BREAKPOINT 1 LINEAR ADDRESS 


BREAKPOINT 2 LINEAR ADDRESS 


BREAKPOINT 3 LINEAR ADDRESS 


Intel reserved. Do not define. 


Intel reserved. Do not define. 


iiliiiiilB^^^ 


B 

T 


B 
S 


B 
D 


■li:i 

1 


1 





11 


1 


mi 
jll 


I 


■lilll 

ii 
liiis 


1 


B 
3 


B 
2 


B 

1 


B 



LEN 
3 


R 
3 


W 
3 


LEN 
2 


R 
2 


W 
2 


LEN 
1 


R 

1 


W 
1 


LEN 



R 



W 






1 


G 
D 


1 


1 





G 

E 


L 

E 


G 
3 


L 
3 


G 
2 


L 
2 


G 

1 


L 
1 


G 



L 





31 16 15 

NOTE: 

indicates Intel reserved: Do not define; SEE SECTION 2.3.10 



Figure 9.1. Debug Registers 



LENi 
Encoding 


Brealtpoint 
Field Width 


Usage of Least 

Significant Bits in 

Breakpoint Address 

Register i, (1 = 0-3) 


00 


1 byte 


All 32-bits used to 
specify a single-byte 
breakpoint field. 


01 


2 bytes 


A1-A31 used to specify 
a two-byte, word- 
aligned breakpoint field. 
AO in Breakpoint 
Address Register is not 
used. 


10 


Undefined- 
do not use 
this encoding 




11 


4 bytes 


A2-A31 used to specify 
a four-byte, dword- 
aligned breakpoint field. 
AO and A1 in 
Breakpoint Address 
Register are not used. 



The LENi field controls the size of breakpoint field i 
by controlling whether all low-order linear address 
bits in the breakpoint address register are used to 
detect the breakpoint event. Therefore, ail break- 
point fields are aligned; 2-byte breakpoint fields be- 
gin on Word boundaries, and 4-byte breakpoint 
fields begin on Dword boundaries. 

The following Is an example of various size break- 
point fields. Assume the breakpoint linear address in 
DR2 is 00000005H. In that situation, the following 
Illustration indicates the region of the breakpoint 
field for lengths of 1 , 2, or 4 bytes. 



DR2 = 0C 

31 


I000005H 


; LEN2 


= OOB 




00000008H 
00000004H 
OOOOOOOOH 














bkpt fld2 
















DR2 = 0C 

31 


000005H 


; LEN2 


= 01B 




00000008H 
00000004H 
OOOOOOOOH 














<— bkptfld2 -> 














DR2 = 0C 

31 


I000005H 


; LEN2 


= 11B 




00000008H 
00000004H 
OOOOOOOOH 










<r- bkptfld2 -^ 















RWi (memory access qualifier bits) 

A 2-bit RW field exists for each of the four break- 
points. The 2-bit RW field specifies the type of usage 
which must occur in order to activate the associated 
breakpoint. 
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RW 
Encoding 


Usage 
Causing Breakpoint 


00 
01 
10 

11 


Instruction execution only 

Data writes only 

Undefined— do not use this encoding 

Data reads and writes only 



RW encoding 00 is used to set up an instruction 
execution breakpoint. RW encodings 01 or 11 are 
used to set up write-only or read/write data break- 
points. 

Note that instruction execution brealtpoints are 
taicen as faults (i.e., before the instruction exe- 
cutes), but data breakpoints are taken as traps 

(i.e., after the data transfer takes place). 

Using LENI and RWi to Set Data Breakpoint I 

A data breakpoint can be set up by writing the linear 
address into DRI (i = 0-3). For data breakpoints, 
RWi can = 01 (write-only) or 1 1 (write/read). LEN 
can = 00, 01, or 11. 

If a data access entirely or partly falls within the data 
breakpoint field, the data breakpoint condition has 
occurred, and if the breakpoint is enabled, an excep- 
tion 1 trap will occur. 

Using LENi and RWi to Set Instruction Execution 
Breakpoint i 

An Instruction execution breakpoint can be set up by 
writing address of the beginning of the Instruction 
(including prefixes If any) into DRi (i = 0-3). RWi 
must = 00 and LEN must = 00 for instruction exe- 
cution breakpoints. 

If the instruction beginning at the breakpoint address 
Is about to be executed, the Instruction execution 
breakpoint condition has occurred, and if the break- 
point is enabled, an exception 1 fault will occur be- 
fore the instruction is executed. 

Note that an instruction execution breakpoint ad- 
dress must be equal to the beginning byte address 
of an instruction (Including prefixes) in order for the 
instruction execution breakpoint to occur. 

GD (Global Debug Register access detect) 

The Debug Registers can only be accessed in Real 
Mode or at privilege level in Protected Mode. The 
GD bit, when set, provides extra protection against 
any Debug Register access even in Real Mode or at 
privilege level in Protected Mode. This additional 
protection feature Is provided to guarantee that a 
software debugger can have full control over the De- 



bug Register resources when required. The GD bit, 
when set, causes an exception 1 fault if an instruc- 
tion attempts to read or write any Debug Register. 
The GD bit is then automatically cleared when the 
exception 1 handler is invoked, allowing the excep- 
tion 1 handler free access to the debug registers. 

GE and LE (Exact data breakpoint match, global and 
local) 

The breakpoint mechanism of the Intel486 Micro- 
processor differs from that of the 386. The Intel486 
Microprocessor always does exact data breakpoint 
matching, regardless of GE/LE bit settings. Any data 
breakpoint trap will be reported exactly after comple- 
tion of the instruction that caused the operand trans- 
fer. Exact reporting is provided by forcing the In- 
tel486 Microprocessor execution unit to wait for 
completion of data operand transfers before begin- 
ning execution of the next instruction. 

When the Intel486 Microprocessor performs a task 
switch, the LE bit is cleared. Thus, the LE bit sup- 
ports fast task switching out of tasks, that have 
enabled the exact data breakpoint match for their 
task-local breakpoints. The LE bit is cleared by the 
processor during a task switch, to avoid having ex- 
act data breakpoint match enabled in the new task. 
Note that exact data breakpoint match must be re- 
enabled under software control. 

The Intel486 Microprocessor GE bit Is unaffected 
during a task switch. The GE bit supports exact data 
breakpoint match that is to remain enabled during all 
tasks executing in the system. 

Note that instruction execution breakpoints are al- 
ways reported exactly. 

Gi and Li (breakpoint enable, global and local) 

If either Gi or Li Is set then the associated breakpoint 
(as defined by the linear address in DRi, the length 
in LENi and the usage criteria In RWI) is enabled. If 
either Gi or LI is set, and the Intel486 Microproces- 
sor detects the ith breakpoint condition, then the ex- 
ception 1 handler is invoked. 

When the Intel486 Microprocessor performs a task 
switch to a new Task State Segment (TSS), all Li 
bits are cleared. Thus, the Li bits support fast task 
switching out of tasks that use some task-local 
breakpoint registers. The Li bits are cleared by the 
processor during a task switch, to avoid spurious ex- 
ceptions in the new task. Note that the breakpoints 
must be re-enabled under software control. 

All Intel486 Microprocessor Gi bits are unaffected 
during a task switch. The Gi bits support breakpoints 
that are active in all tasks executing in the system. 
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9.3.3 DEBUG STATUS REGISTER (DR6) 

A Debug Status Register, DR6 shown in Figure 9.1, 
allows the exception 1 handler to easily determine 
why it was invoked. Note the exception 1 handler 
can be invoked as a result of one of several events: 

1) DRO Breakpoint fault/trap. 

2) DR1 Breakpoint fault/trap. 

3) DR2 Breakpoint fault/trap. 

4) DR3 Breakpoint fault/trap. 

5) Single-step (IF) trap. 

6) Task switch trap. 

7) Fault due to attempted debug register access 
when GD=1. 

The Debug Status Register contains single-bit flags 
for each of the possible events Invoking exception 1 . 
Note below that some of these events are faults (ex- 
ception taken before the instruction is executed), 
while other events are traps (exception taken after 
the debug events occurred). 

The flags in DR6 are set by the hardware but never 
cleared by hardware. Exception 1 handler software 
should clear DR6 before returning to the user pro- 
gram to avoid future confusion in identifying the 
source of exception 1 . 

The fields within the Debug Status Register, DR6, 
are as follows: 

Bi (debug fault/trap due to breakpoint 0-3) 

Four breakpoint indicator flags, B0-B3, correspond 
one-to-one with the breakpoint registers in DRO- 
DR3. A flag Bi is set when the condition described 
by DRi, LENi, and RWi occurs. 

If Gi or Li is set, and if the ith breakpoint Is detected, 
the processor will invoke the exception 1 handler. 
The exception is handled as a fault if an instruction 
execution breakpoint occurred, or as a trap if a data 
breakpoint occurred. 



IMPORTANT NOTE: A flag Bi is set whenever the 
hardware detects a match condition on enabled 
breakpoint i. Whenever a match is detected on at 
least one enabled breakpoint i, the hardware imme- 
diately sets all Bi bits corresponding to breakpoint 
conditions matching at that instant, whether enabled 
or not. Therefore, the exception 1 handler may see 
that multiple Bi bits are set, but only set Bi bits corre- 
sponding to enabled breakpoints (Li or Gi set) are 
true indications of why the exception 1 handler was 
invoked. 

BD (debug fault due to attempted register access 
when GD bit set) 

This bit is set If the exception 1 handler was Invoked 
due to an instruction attempting to read or write to 
the debug registers when GD bit was set. If such an 
event occurs, then the GD bit is automatically 
cleared when the exception 1 handler is invoked, 
allowing handler access to the debug registers. 

BS (debug trap due to single-step) 

This bit is set if the exception 1 handler was invoked 
due to the TF bit in the flag register being set (for 
single-stepping). 

BT (debug trap due to task switch) 

This bit is set if the exception 1 handler was invoked 
due to a task switch occurring to a task having a 
Intel486 Microprocessor TSS with the T bit set. Note 
the task switch into the new task occurs normally, 
but before the first instruction of the task is execut- 
ed, the exception 1 handler Is invoked. With respect 
to the task switch operation, the operation is consid- 
ered to be a trap. 



9.3.4 USE OF RESUME FLAG (RF) IN FLAG 
REGISTER 

The Resume Flag (RF) in the flag word can sup- 
press an instruction execution breakpoint when the 
exception 1 handler returns to a user program at a 
user address which is also an instruction execution 
breakpoint. 
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10.0 INSTRUCTION SET SUMMARY 

This section describes the Intel486 Microprocessor 
instruction set. Tables 10.1 through 10.3 list all in- 
structions along with Instruction encoding diagrams 
and clock counts. Further details of the instruction 
encoding are then provided in Section 10.2, which 
completely describes the encoding structure and the 
definition of all fields occurring within the Intel486 
Microprocessor instructions. 

10.1 lntel486TM Microprocessor 
Instruction Encoding and Clock 
Count Summary 

To calculate elapsed time for an instruction, multiply 
the instruction clock count, as listed in Tables 10.1 
through 10.3 by the processor clock period (e.g., 
40 ns for a 25 MHz Intel486 Microprocessor). 

For more detailed information on the encodings of 
instructions, refer to Section 10.2 Instruction Encod- 
ings. Section 10.2 explains the general structure of 
instruction encodings, and defines exactly the en- 
codings of all fields contained within the instruction. 

INSTRUCTION CLOCK COUNT ASSUMPTIONS 

The Intel486 Microprocessor instruction clock count 
tables give clock counts assuming data and instruc- 
tion accesses hit in the cache. A separate penalty 
column defines clocks to add if a data access miss- 
es in the cache. The combined instruction and data 
cache hit rate is over 90%. 

A cache miss will force the Intel486 Microprocessor 
to run an external bus cycle. The Intel486 Micro- 
processor 32-bit burst bus is defined as r-b-w. 

Where: 

r = The number of clocks in the first cycle of a 
burst read or the number of clocks per data 
cycle in a non-burst read. 

b = The number of clocks for the second and sub- 
sequent cycles in a burst read. 

w = The number of clocks for a write. 

The fastest bus the Intel486 microprocessor can 
support is 2-1-2 assuming wait states. The 
clock counts in the cache miss penalty column as- 
sume a 2-1-2 bus. For slower busses add r-2 
clocks to the cache miss penalty for the first dword 
accessed. Other factors also affect Instruction clock 
counts. 

Instruction Clock Count Assumptions 

1 . The external bus Is available for reads or writes 
at all times. Else add clocks to reads until the 
bus is available. 



2. Accesses are aligned. Add three clocks to each 
misaligned access. 

3. Cache fills complete before subsequent access- 
es to the same line. If a read misses the cache 
during a cache fill due to a previous read or pre- 
fetch, the read must wait for the cache fill to 
complete. If a read or write accesses a cache 
line still being filled, it must wait for the fill to 
complete. 

4. If an effective address is calculated, the base 
register is not the destination register of the pre- 
ceding instruction. If the base register is the 
destination register of the preceding instruction 
add 1 to the clock counts shown. Back-to-back 
PUSH and POP instructions are not affected by 
this rule. 

5. An effective address calculation uses one base 
register and does not use an index register. 
However, if the effective address calculation 
uses an index register, 1 clock may be added to 
the clock count shown. 

6. The target of a jump is in the cache. If not, add r 
clocks for accessing the destination instruction 
of a jump. If the destination instruction is not 
completely contained in the first dword read, 
add a maximum of 3b clocks. If the destination 
Instruction Is not completely contained In the 
first 16 byte burst, add a maximum of another 
r+3b clocks. 

7. If no write buffer delay, w clocks are added only 
in the case in which all write buffers are full. 
Typically, this case rarely occurs. 

8. Displacement and Immediate not used together. 
If displacement and immediate used together, 1 
clock may be added to the clock count shown. 

9. No invalidate cycles. Add a delay of 1 clock for 
each invalidate cycle if the invalidate cycle con- 
tends for the internal cache/external bus when 
the Intel486 CPU needs to use it. 

1 0. Page translation hits in TLB. A TLB miss will add 
13, 21 or 28 clocks to the instruction depending 
on whether the Accessed and/or Dirty bit in nei- 
ther, one or both of the page entries needs to 
be set In memory. This assumes that neither 
page entry is in the data cache and a page fault 
does not occur on the address translation. 

11. No exceptions are detected during Instruction 
execution. Refer to Interrupt Clock Counts Ta- 
ble for extra clocks if an interrupt is detected. 

12. Instructions that read multiple consecutive data 
Items (i.e. task switch, POPA, etc.) and miss the 
cache are assumed to start the first access on a 
1 6-byte boundary. If not, an extra cache line fill 
may be necessary which may add up to (r+3b) 
clocks to the cache miss penalty. 
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Table 10.1 


. lntel486TM Microprocessor Integer Clock Count Summary 




INSTRUCTION 


FORMAT 


Cache Hit 


Penalty If 
Cache Miss 


Notes 


INTEGER OPERATIONS 
MOV = Move: 

reg1 to reg2 

reg2 to reg1 
memory to reg 
reg to memory 
Immediate to reg 

or 
Immediate to Memory 
Memory to Accumulator 
Accumulator to Memory 

MOVSX/MOVZX = Move with Sign/Ze 

reg2toreg1 

memory to reg 




3 
3 

4 
1 
4 
1 
11 

4 
1 
5 
9 

3 
3 
5 
1 

1 
2 


2 

2 
2 

1 

1 

2 

2 

7/15 


1 

1 
16/32 

2 
2 
2 


1000100W |l 1 reg1 reg2| 




1 1 1 w 1 1 1 reg1 reg2 1 




1 1 1 w 1 mod reg r/m | 




1 1 w 1 mod reg r/m | 




1 1 1 1 w 1 1 1 reg 1 immediate data 




1 01 1 w reg | immediate data 




nooonwlmodooo r/m j ^'^^'.^^ "' 




1 1 w 1 full displacement 




1 1 1 w 1 full displacement 


ro Extension 


00001111 1 1011z11w |l1 regl reg2 1 




00001111 1 lOllzllw 1 mod reg r/m | 




z instruction 

MOVZX 

1 MOVSX 


PUSH = Push 

reg 

or 
memory 
immediate 
PUSHA = Push Ail 

POP = Pop 

reg 

or 
memory 
POPA = Pop Ail 

XCHG = Exchange 

reg1 with reg2 

Accumulator with reg 
Memory with reg 
NOP = No Operation 

LEA = Load EA to Register 

no index register 
with index register 


11111111 1 1 1 110 reg| 


010 10 reg 1 




11111111 1 mod 1 1 r/m 1 




1 1 1 s 1 immediate data 




01 100000 1 




10 01111 1 1 1 reg 1 




01011 reg 1 




10 01111 1 mod r/m | 




01 100001 1 




100001 1w 1 1 1 regl reg2| 




10 010 reg 1 




1 1 1 w 1 mod reg r/m | 




10010000 1 




10 01101 1 mod reg r/m | 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 




Cache Hit 


Penalty If 
Cache Miss 


Notes 


INTEGER OPERATIONS (Continued) 






1 
1 
2 
3 
1 
1 
3 

1 
1 
3 

1 
3 

1 

1 
2 
2 

1 
1 
2 

1 
2 
1 

1 
2 


2 
6/2 

6/2 

6/2 

6/2 

2 
2 

2 
2 

2 


U/L 
U/L 

U/L 
U/L 


Instruction 


TTT 


ADD = Add 

ADC = Add with Carry 

AND = Logical AND 

OR = Logical OR 

SUB = Subtract 

SBB = Subtract with Borrow 

XOR = Logical Exclusive OR 


000 
010 
100 
001 
101 
011 
110 


reg1 to reg2 
reg2 to reg1 
memory to register 
register to memory 
immediate to register 
immediate to accumulator 
immediate to memory 




1 OOTTTOOw 


1 1 1 regl reg2 1 


1 OOTTTOIw 


1 1 1 regl reg2 1 


1 OOTTTOIw 


1 mod reg r/m | 


1 OOTTTOOw 


1 mod reg r/m j 


1 lOOOOOsw 


1 1 1 TTT reg 1 immediate register 
immediate data 


1 00TTT1 Ow 


1 lOOOOOsw 


1 mod TTT r/m j immediate data 


Instruction 


TTT 


INC = Increment 
DEC = Decrement 


000 
001 


reg 
or 
memory 




1 1 1 1 1 1 1 1w 


11 TTT reg| 

1 


1 01 TTT reg 


1 1 1 1 1 1 1 1w 


mod TTT r/m| 


Instruction 


TTT 


NOT = Logical Complement 
NEG = Negate 


010 
011 


reg 
memory 

CMP = Compare 

reg1 with reg2 

reg2 with regl 
memory with register 
register with memory 
immediate with register 
immediate with ace. 
immediate with memory 

TEST = Logical Compare 

reg1 and reg2 

memory and register 
immediate and register 
immediate and ace. 
immediate and memory 




1 1 11 101 1w 


|l1 TTT reg| 


1 1 1 1 101 1w 


mod TTT r/m| 


1 001 1 lOOw 


1 1 regl reg2 1 


1 001 1 lOlw 


1 1 1 regl reg2 1 


1 001 1 lOOw 


mod reg r/m | 


1 001 1 1 01 w 


1 mod reg r/m | 


1 lOOOOOsw 


1 1 1 111 reg 1 immediate data 
1 immediate data 


1 001 1 1 1 Ow 


1 lOOOOOsw 


1 mod 111 r/m 1 Immediate data 


1 1 00001 Ow 


1 1 1 regl reg2 | 


1 lOOOOlOw 


1 mod reg r/m | 


1 1 1 1 1 01 1w 


1 1 1 reg 1 immediate data 
1 immediate data 


1 101 OlOOw 


1 1 1 1 1 01 1w 


1 mod r/m | immediate data 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 




Cache Hit 


Penalty If 
Cache Miss 


Notes 


INTEGER OPERATIONS (Continued) 
MUL= Multiply (unsigned) 

ace. witii register 

Multiplier-Byte 
Word 
Dword 

ace. witii memory 

Multiplier-Byte 
Word 
Dword 

IMUL = Integer Multiply (signed) 

ace. with register 
Multiplier-Byte 
Word 
Dword 

aee. with memory 
Multiplier-Byte 
Word 
Dword 

reg1 with reg2 

Multiplier-Byte 
Word 
Dword 

register with memory 

Muitiplier-Byte 
Word 
Dword 

reg1 with imm. to reg2 

Muitiplier-Byte 
Word 
Dword 

mem. with imm. to reg. 

Multiplier-Byte 
Word 
Dword 
DIV = Divide (unsigned) 

aee. by register 
Divisor-Byte 
Word 
Dword 

ace. by memory 
Divisor-Byte 
Word 
Dword 

IDIV = Integer Divide (signed) 

ace. by register 
Divisor-Byte 
Word 
Dword 






13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

13/18 
13/26 
13/42 

16 
24 
40 

16 
24 
40 

19 
27 
43 


1 
1 
1 

1 
1 
1 

2 
2 
2 


MN/MX.3 
MN/MX, 3 
MN/MX, 3 

MN/MX, 3 
MN/MX.3 
MN/MX.3 

MN/MX.3 
MN/MX.3 
MN/MX, 3 

MN/MX.3 
MN/MX, 3 
MN/MX.3 

MN/MX. 3 
MN/MX.3 
MN/MX.3 

MN/MX.3 
MN/MX.3 
MN/MX.3 

MN/MX.3 
MN/MX.3 
MN/MX.3 

MN/MX.3 
MN/MX. 3 
MN/MX.3 


1 1 1 1 101 1w 


11 10 reg 1 






1 1 1 1 101 1w 


mod 1 r/m | 






1 1 1 1 101 1w 


11 101 reg 1 






1 1 1 1 101 1w 


mod 1 1 r/m | 






1 00001 1 1 1 


10101111 1 1 1 regl reg2 1 






1 00001 1 1 1 


10101111 1 mod reg r/m | 






1 01 lOIOsI 


1 1 reg1 reg2 1 immediate data 






1 01 lOIOsI 


mod reg r/m| immediate data 






1 1 1 1 101 1w 


11 110 reg 1 






1 1 1 1 101 1w 


mod 1 1 r/m | 






1 1 1 1 101 1w 


11 111 reg 1 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 


Cache Hit 


Penalty If 
Cache Miss 


Notes 


INTEGER OPERATIONS (Continued) 

ace. by memory 
Divisor-Byte 
Word 
Dword 

CBW/CWD = Convert Byte to Word/ 

Convert Word to Dworc 
CWD/CDQ = Convert Word to Dword/ 

Convert Dword to 

Quad Word 




20 
28 
44 

3 

3 

3 

4 
3 
4 
2 
4 

3 

4 
8/30 
9/31 
8/30 
9/31 

2 
3 
3 
4 
1 

3 
4 

6 
7/10 


6 
6 
6 

6 

6 
5 

6/2 
2 


MN/MX, 4 
MN/MX, 5 
MN/MX, 4 
MN/MX, 5 

U/L 
6 


1 1 1 1 101 1 w|mod1 11 r/m| 


1 1 1001 iooo| 


1 1001 1001 1 


Instruction 


TTT 


ROL = Rotate Left 

ROR = Rotate Right 

ROL = Rotate through Carry Left 

RCR = Rotate through Carry Right 

SHL/SAL = Shift Logical /Arithmetic L 

SHR = Shift Logical Right 

SAR = Shift Arithmetic Right 

Not Through Carry (ROL, ROR, SAL, SA 

reg by 1 [ 

memory by 1 1 
reg by CL [ 
memory by CL [ 
reg by immediate count [ 
mem by immediate count [ 

Through Carry (RCL and RCR) 

reg by 1 [ 

memory by 1 [ 
regbyCL [ 
memory by CL 1 
reg by immediate count 1 
mem by immediate count [ 


000 
001 
010 

oil 

eft 100 
101 
111 

R, SHL, and SHR) 


IIOIOOOwjII TTT reg| 




1 lOIOOOw |mod TTT r/m| 




1 101001 w |l 1 TTT reg| 




1 101001 w |mod TTT r/m| 




1100000w|l1 TTT reg 1 immediate e-bit data 




1 1 w 1 mod T T T r/m | immediate 8-bit data 




1 101 000 w |l 1 TTT reg| 




1 lOIOOOw |mod TTT r/m| 




1 1 01 001 w 1 1 1 TTT reg| 




1 101001 w |mod TTT r/m| 




1100000w|l1 TTT reg 1 immediate 8-bit data 




1 1 w 1 mod T T T r/m | immediate 8-bit data 


Instruction 


TTT 


SHLD = Shift Left Double 
SHRD = Shift Right Double 


100 
101 


register with immediate 1 
memory by immediate 1 
register by CL 1 
memory by CL 1 
BSWAP = Byte Swap [ 

XADD = Exchange and Add 

reg1,reg2 [ 

memory, reg 1 

CMPXCHG = Compare and Exchange 

reg1,reg2 [ 

memory, reg [ 




00001111 10TTT100 11 reg2 reg 1 1 imm 8-bit data 




00001111 |lOTTT100 |mod reg r/m | imm 8-bit data 




00001111 |lOTTT101 |l1 reg2 regl 1 




00001111 |lOTTT101 |mod reg r/m| 




01111 1 1 1 1 reg 1 




00001111 InOOOOOw |l1 reg2 regl | 




00001111 |l100000w 1 mod reg r/m | 




00001111 |l011000w |l1 reg2 regl | 




00001111 |l011000w |mod reg r/m| 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION FORMAT 


Cache Hit 


Penalty If 
Cache Miss 


Notes 


CONTROL TRANSFER (within segment) 








NOTE: Times are jump tal<en/not tal<en 








Jccc = Jump on ccc 


3/1 
3/1 




T/NT, 23 
T/NT. 23 


8-bit displacement | 1 1 1 1 1 1 n | 8-bit disp. | 




full displacement | 00001111 | lOOOtttn | full displacement 


NOTE: Times are jump taken/not taken 








SETcccc = Set Byte on cccc (Times are coco true/false) 








reg | 00 001111 | lOOItttn |l1 000 reg| 


4/3 
3/4 






memory | 00001111 | lOOItttn |modOOO r/m | 


Mnemonic ^ _,,^, 

Condition tttn 


O Overflow 0000 


NO No Overflow 0001 








B/NAE Below/Not Above or Equal 001 








NB/AE Not Below/ Above or Equal 0011 








E/Z Equal/Zero 0100 








NE/NZ Not Equal/Not Zero 0101 








BE/NA Below or Equal/Not Above 0110 








NBE/A Not Below or Equal/Above 0111 








8 Sign 1000 








NS Not Sign 1001 








P/PE Parity/Parity Even 1010 








NP/PO Not Parity/Parity Odd 1 01 1 








L/NGE Less Than/Not Greater or Equal 1 1 00 








NL/GE Not Less Tiian/Greater or Equal 1101 








LE/NG Less Tiian or Equal/Greater Thian 1110 








NLE/G Not Less Than or Equal/Greater Than 1111 


7/6 
9/6 

9/6 

8/5 
8/5 




L/NL, 23 
L/NL, 23 

L/NL. 23 

T/NT, 23 
T/NT, 23 


LOOP = LOOP CX Times | 11100010 | 8-bit disp. | 




LOOPZ/LOOPE = Loop with | 1110 01 | 8-bit disp. | 


Zero/Equal 


LOOPNZ/LOOPNE = Loop while | 11100000 | 8-bit disp. | 


Not Zero 


JCXZ = Jump on CX Zero | 11100011 | 8-bit disp. | 




JECXZ = Jump on ECX Zero | 1110 011 | 8-bit disp. | 


(Address Size Prefix Differentiates JCXZ for JECXZ) 


JMP = Unconditional Jump (within segment) 


3 
3 
5 
5 

3 
5 
5 

5 
5 


5 

5 ' 

5 
5 


7,23 

7,23 

7,23 

7 

7,23 
7.23 

7 


Short 1 11101011 1 8-bit disp. | 




Direct | 111010 01 | full displacement 




Register Indirect | 11111111 | 1 1 10 reg | 


(Memory Indirect | 1 1 1 1 1 1 1 1 mod 1 r/m | 


CALL = Call (within segment) 


Direct | 111010 | full displacement 




Register Indirect | 11111111 | 1 1 010 reg | 




Memory Indirect | 11111111 mod 010 r/m | 




1 1 100001 1 1 




Adding Immediate to SP | 1 1 1 | 1 6-bit disp. | 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 




Cache Hit 


Penalty if 
Cache Miss 


Notes 


CONTROL TRANSFER (within segmen 

ENTER = Enter Procedure 

Level = 
Level = 1 
Level (L) > 1 

LEAVE = Leave Procedure 

MULTIPLE-SEGMENT INSTRUCTIONS 
MOV = Move 

reg. to segment reg. 

memory to segment reg. 
segment reg. to reg. 
segment reg. to memory 

PUSH = Push 

segment reg. 
(ES, CS, 83, or DS) 

segment reg. (FS or GS) 

POP = Pop 

segment reg. 
(ES, SS, or DS) 

segment reg. (FS or GS) 
LDS= Load Pointer to DS 
LES= Load Pointer to ES 
LFS = Load Pointer to FS 
LGS = Load Pointer to GS 
LSS = Load Pointer to SS 
CALL = Call 

Direct Intersegment 

to same level 

thru Gate to same level 

to inner level, no parameters 

to inner level, x parameter (d) words 

toTSS 

thru Task Gate 

Indirect intersegment 
to same level 
thru Gate to same level 
to inner level, no parameters 
to inner level, x parameter (d) words 
toTSS 

thru Task Gate 
RET = Return from CALL 

intersegment 
to same level 
to outer level 

intersegment adding 
imm. to SP 

to same level 
to outer level 


(Continued) 




14 

17 

17 + 3L 

5 

3/9 
3/9 
3 

3 

3 
3 

3/9 

3/9 
6/12 
6/12 
6/12 
6/12 
6/12 

18 

20 

35 

69 
77 + 4X 
37+TS 
38+ IS 

17 

20 

35 

69 

77 + 4X 

37 + TS 

38 + TS 

. 13 
17 
35 

14 
18 
36 


1 

0/3 
2/5 

2/5 

2/5 
7/10 
7/10 
7/10 
7/10 
7/10 

2 

3 
6 
17 
17 + n 
3 
3 

8 
10 
13 
24 
24 + n 
10 
10 

8 
9 
12 

8 
9 
12 


8 

RV/P, 9 
RV/P. 9 

RV/P, 9 

RV/P, 9 
RV/P, 9 
RV/P, 9 
RV/P, 9 
RV/P, 9 
RV/P, 9 

R,7,22 

P. 9 

P. 9 

P. 9 
P.11,9 
P,10,9 
P. 10,9 

R.7 

P,9 

P,9 

P,9 
P.11,9 
P, 10,9 
P,10,9 

R,7 
P,9 
P. 9 

R,7 

P. 9 
P,9 


1 1001000 


|l6-bitdisp., 8-bit level 

1 


1 1 001 001 


10001 1 10 


1 1 1 sreg3 reg | 


10001 1 10 


1 mod sreg3 r/m | 


10001 100 


1 1 1 sreg3 reg | 


10001 100 


1 mod sregS r/m | 

1 


sreg2 1 1 


00001 1 1 1 


10 sregSOOol 

I 


sreg2 1 1 1 


00001 1 1 1 


1 sregS 1 | 


11000101 


mod reg r/m | 


1 1000100 


1 mod reg r/m | 


00001 1 1 1 


1 1 1 1 1 mod reg r/m | 


00001 1 1 1 


1 1 1 1 1 1 mod reg r/m | 


00001 1 1 1 


1 1 1 1 1 mod reg r/m | 
unsigned full offset, selector 


1001 1010 


11111111 


1 mod 1 1 r/m | 

1 


1 100101 1 


1 1001010 


1 1 6-bit disp. 1 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 






Cache Hit 


Penalty if 
Cache Miss 


Notes 


MULTIPLE-SEGMENT INSTRUCTIONS 

Direct intersegment 

to same level 

thru Call Gate to same level 

thruTSS 

thru Task Gate 

Indirect intersegment 

to same level 

thru Call Gate to same level 

thruTSS 

thru Task Gate 

BIT MANIPULATION 
BT = Test bit 

register, immediate 

memory, immediate 
reg1,reg2 
memory, reg 


) (Continued) 


1 unsigned full offs 


et, selector 

1 


17 

19 
32 

42 + TS 

43 + TS 

13 

18 

31 
41+TS 
42 + TS 

3 
3 
3 
8 

6 
8 
6 
13 

6/42 
7/43 

6/103 
7/104 

8 
5 

7 
6 
5 

4 


2 

3 
6 
3 
3 

9 

10 
13 
10 
10 

1 
2 

2/0 
3/1 

2 

1 

6 

2 

2 
2 

2 


R, 7, 22 

P. 9 

P. 9 
P. 10, 9 
P, 10, 9 

R.7,9 

P. 9 

P. 9 
P,10,9 
P, 10,9 

U/L 

U/L 

MN/MX, 12 
MN/MX, 13 

MN/MX, 14 
MN/MX. 15 

16 
16 


1 11101010 


1 11111111 


mod 101 r/m 


1 00001 1 1 1 


1 10111010 


1 1 1 10 reg 1 imm. 8-bit data 


1 00001 1 1 1 


1 10111010 


1 mod 10 r/m 1 imm. 8-bit data 


1 00001 1 1 1 


1010001 1 


1 1 1 reg2 regl | 


1 00001 1 1 1 


1 1010001 1 


1 mod reg r/m | 


Instruction 


TTT 


BTS = Test Bit and Set 
BTR = Test Bit and Reset 
BTC = Test Bit and Compliment 


101 
110 
111 


register, immediate 
memory, immediate 
reg1,reg2 
memory, reg 

BSF = Scan Bit Forward 

reg1,reg2 

memory, reg 

BSR = Scan Bit Reverse 

regl , reg2 

memory, reg 

STRING INSTRUCTIONS 
CMPS = Compare Byte Word 

LODS = Load Byte/Word 

toAL/AX/EAX 

MOVS = Move Byte/Word 
SCAS = Scan Byte/Word 

STOS = Store Byte/Word 

from AL/ AX/EX 

XLAT = Translate String 




1 00001 1 1 1 


10111010 


|l1 TTT reg 1 imm. 8-bit data 


1 00001 1 1 1 


|l01 11010 


1 mod TTT r/m | imm. 8-bit data 


looooi 1 1 1 


1 10TTT01 1 


1 1 1 reg2 regl | 


1 00001 1 1 1 


1 10TTT01 1 


1 mod reg r/m | 


1 00001 1 1 1 


1 101 1 1 100 


1 1 1 reg2 reg1 | 


1 00001 1 1 1 


1 101 1 1 100 


1 mod reg r/m | 


1 00001 1 1 1 


1 10111101 


1 1 1 reg2 reg1 | 


1 00001 1 1 1 


1 10111101 

1 


1 mod reg r/m | 


1 101001 1w 


1 10101 lOw 


1 1010010W 


1 10101 1 1w 


1 1010101W 


1 11010111 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 




Cache Hit 


Penalty If 
Cache Miss 


Notes 


REPEATED STRING INSTRUCTIONS 

Repeated by Count in CX or ECX (C = 

REPE CMPS = Compare String 

(Find Non-Match) 

C = 

C>0 

REPNECMPS = Compare String 

(Find IVIatch) 
C = 
OO 

REP LCDS = Load String 

= 
C> 

REP MOVS = Move String 

C = 
0= 1 
01 

REPE SCAS = Scan string 

(Find Non-AL/AX/EAX) 

C = 

OO 

REPNE SCAS - Scan String 

(Find AL/AX/EAX) 

C = 

OO 

REP STOS = Store String 

= 
OO 

FLAG CONTROL 

CLC = Clear Carry Flag 

STC = Set Carry Flag 

CMC = Complement Carry Flag 

CLD = Clear Direction Flag 

STD = Set Direction Flag 

CLI = Clear Interrupt 
Enable Flag 

STI = Set Interrupt 
Enable Flag 

LAHF = Load AH Into Flag 

SAHF = Store AH Into Flags 

PUSHF = Push Flags 

POPF = Pop Flags 

DECIMAL ARITHMETIC 
AAA = ASCII Adjust for Add 

AAS = ASCII Adjust for 
Subtract 

AAM = ASCII Adjust for 
Multiply 


Count in OX or ECX) 




5 
7 + 70 

5 
7 + 7c 

5 
7 + 4C 

5 

13 

12 + 30 

5 
7 + 5c 

5 
7 + 5c 

5 
7 + 4c 

2 
2 
2 
2 
2 
5 

5 

3 

2 
4/3 
9/6 

3 
3 

15 


1 


16.17 

16,17 

16,18 

16 
16,19 

20 

20 

RV/P 
RV/P 


1 1 1 1 1001 1 1 


101001 1w 1 






1 1 1 1 10010 1 


101001 1w 1 






1 1 1 1 1001 1 1 


10101 lOw 1 






1 11110011 1 


1010010W 1 






1 11110011 1 


10101 1 1w 1 






1 11110010 1 


10101 1 1w 1 






1 11110011 1 


1010101W 1 






1 1 1 1 1 1000 1 


1 11111001 1 


1 11110101 1 




1 1 1 1 1 1 100 1 


1 11111101 1 


1 11111010 1 


1 11111011 1 


1 10011111 1 


1 10011110 1 


1 1001 1 100 1 


1 10011101 1 




1 001 101 1 1 1 


1 001 1 1 1 1 1 1 


1 1 1 010100 


00001010 1 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 



Penalty If 
Cache Miss 



DECIMAL ARITHMETIC (Continued) 
AAD = ASCII Adjust for 



11010101 00001 



^77) 



DAA = Decimal Adjust for Add | 001001 1 l| 

DAS = Decimal Adjust for Subtract f 1 1 1 1 l| 

PROCESSOR CONTROL INSTRUCTIONS 

HLT = Halt I 1 1 1 10100 I 



MOV = Move To and From Control/Debug/Test Registers 

CRO from register 



Q 



0001 111 00100010 



CR2/CR3 from register 

Reg from CRO-3 

DRO-3 from register 

DR6-7 from register 

Register from DR6-7 

Register from DRO-3 

TR3 from register 

TR4-7 from register 

Register from TR3 

Register from TR4-7 
CLTS = Clear Task Switched Flag 
INVD = Invalidate Data Cache 



00001 111 00100010 



Q 



0001 111 00100000 



00001 111 0010001 1 



00001 111 0010001 1 



00001 111 00100001 



00001 111 00100001 



I 



00001 111 001001 1 



00001 111 001001 1 



I 00001 1 1 1 I 00100100 



I 00001 1 1 1 I 00100100 



00001 111 000001 1 



00001 111 00001000 



00001111 I 00000001 I mod 111 r/m | 



WBINVD = Write-Back and Invalidate | 00001 1 1 1 | 00001001 
Data Cache 

INVLPG = Invalidate TLB Entry 

INVLPG memory 



PREFIX BYTES 
Address Size Prefix 
LOCK = Bus Lock Prefix 
Operand Size Prefix 

Segment Override Prefix 

OS: 

OS; 
ES: 
FS: 
GS: 
88: 



11 OOP reg 



11 eee rag 



11 e e e reg 



11 eee reg 



11 eee reg 



11 eee reg 



11 eee reg 



11 011 reg 



11 eee reg 



11 Oil reg 



1 01100111 1 




1 1 1 1 10000 1 




1 01100110 1 




1 00101 1 10 1 




1 001 1 1 1 10 1 




1 001001 10 1 




1 01 100100 




1 01100101 1 




1 00110110 1 



17 
4 
4 
10 
10 

g 

9 
4 
4 
3 
4 

7 
4 
5 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION FORMAT 


Cache Hit 


Penalty if 
Cache Miss 


Notes 


PROTECTION CONTROL 

ARPL = Adjust Requested Privilege Level 


9 
9 

11 
11 

12 

12 

11 

1, 

13 
13 

10 
10 

20 
20 

10 

10 

2 
3 

2 
3 

2 
3 

11 
11 

11 
11 


3 
5 

5 

5 

3 
6 

1 

3 
6 

3 

7 

3 

7 




From register | 0110 011 


1 1 1 regl reg2 1 






From memory | 0110 011 


1 mod reg r/m | 


LAR = Load Access Rights 




From register | 01111 


1 00000010 |l1 regl reg2 1 






From memory | 01111 


1 010 1 mod reg r/m | 


LGDT = Load Global Descriptor 




Table register | 01111 


1 00000001 mod 010 r/m | 


LIDT = Load Interrupt Descriptor 




Table register | 1 1 1 1 


1 01 1 mod Oil r/m | 


LLDT = Load Local Descriptor 




Table register from reg. | 01111 


00000000 |l1 010 regl 






Table register from mem. | 01111 


1 00000000 1 mod 010 r/m | 


LMSW = Load Machine Status Word 




From register | 01111 


1 00000001 |l1 110 reg| 






From memory | 01111 


1 01 1 mod 110 r/m | 


LSL = Load Segment Limit 




From register | 01111 


1 0000 001 1 11 regl reg2 1 






From memory | 01111 


1 011 1 mod reg r/m | 


LTR = Load Task Register 




From Register | 01111 


1 1 1 1 Oil reg 1 






From Memory | 01111 


1 1 mod 1 1 r/m | 


SGDT = Store Global Descriptor Table 




1 00001 1 1 1 


1 01 1 mod r/m | 


SIDT = Store Interrupt Descriptor Table 




1 00001 1 1 1 


1 01 1 mod 01 r/m | 


SLDT = Store Local Descriptor Table 




To register | 01111 


1 00000000 |l1 000 reg| 






To memory | 01111 


1 1 mod r/m | 


SMSW = Store Machine Status Word 




To register | 1 1 1 1 


1 00000001 |l1 100 reg| 






To memory | 01111 


1 0000 00 01 |mod 100 r/m | 


STR = Store Task Register 




To register | 01111 


1 00000000 |l1 001 regl 






To memory | 01111 


1 1 mod 1 r/m | 


VERR = Verify Read Access 




Register | 01111 


1 00000000 |l1 100 r/mj 






Memory | 01111 


1 1 mod 10 r/mj 


VERW = Verify Write Access 




To register | 01111 


1 00000000 |l1 101 regj 






To memory | 01111 


1 000 000 1 mod 101 r/m 1 
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Table 10.1. lntel486TM Microprocessor Integer Clock Count Summary (Continued) 



INSTRUCTION 


FORMAT 


Cache Hit 


Penalty if 
Cache Miss 


Notes 


INTERRUPT INSTRUCTIONS 
INTn = Interrupt Type n 
INT 3 = Interrupt Type 3 
INTO= Interrupt 4 If 




INT+4/0 
INT+0 




RV/P, 21 
21 


1 1 1 1 1 1 1 type 1 


1 11001100 1 


1 11001110 1 


Overflow Flag Set 










Taken 




INT + 2 




21 


Not Taken 
BOUND = Interrupt 5 If Detect 




3 




21 


1 0110 010 1 mod reg r/m | 


Value Out Range 










If in range 




7 


7 


21 


If out of range 
IRET = Interrupt Return 




INT+24 


7 


21 


1 1 1001 1 1 1 1 


Real Mode/Virtual Mode 




15 


8 




Protected Mode 










To same level 




20 


11 


9 


To outer level 




36 


19 


9 


To nested task (EFLAGS.NT = 1) 




TS + 32 


4 


9.10 


External Interrupt 




INT+11 




21 


NMI = Non-Maskable Interrupt 




INT+3 




21 


Page Fault 




INT+24 




21 


VM86 Exceptions 










CLI 




INT +8 




21 


STI 




INT+8 




21 


INTn 




INT +9 






PUSHF 




INT + 9 




21 


POPF 




INT+8 




21 


IRET 




INT + 9 






IN 










Fixed Port 




INT +50 




21 


Variable Port 




INT+51 




21 


OUT 










Fixed Port 




INT +50 




21 


Variable Port 




INT+51 




21 


INS 




INT +50 




21 


OUTS 




INT+50 




21 


REP INS 




INT+51 




21 


REP OUTS 




INT+51 




21 



Task Switch Clock Counts Table 


Method 


Value for TS 


Cache Hit 


Miss Penalty 


VM/lntel486 CPU/286 TSS To Intel486 CPU TSS 
VM/lntel486 CPU/286 TSS To 286 TSS 
VM/lntel486 CPU/286 TSS To VM TSS 


162 
143 
140 


55 
31 
37 
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Interrupt Clock Counts Table 


Method 


Value for INT 


Cache Hit 


Miss Penalty 


Notes 


Real Mode 

Protected Mode 
Interrupt/Trap gate, same level 
Interrupt/Trap gate, different level 
Task Gate 

Virtual Mode 
Interrupt/Trap gate, different level 
Task gate 


26 

44 

71 

37 + TS 

82 
37 + TS 


2 

6 
17 
3 

17 
3 


9 

9 

9,10 

10 



Abbreviations 


Definition 


16/32 


16/32 bit modes '■ 


U/L 


unlocked/locked 


MN/MX 


minimum/maximum 


L/NL 


loop/no loop 


RV/P 


real and virtual mode/protected mode 


R 


real mode 


P 


protected mode 


T/NT 


taken/not taken 


H/NH 


hit/no hit 



NOTES: 

1 . Assuming that the operand address and stack address fall in different cache sets. 

2. Always locked, no cache hit case. 

3. Clocks = 10 + max(log2(|m|),n) 

m = multiplier value (min clocks for m = 0) 
n = 3/5 for ±m 

4. Clocks = {quotient(count/operand length) 1*7 +9 

= 8 if count ^ operand length (8/16/32) 

5. Clocks = {quotient(count/operand length)) *7+ 9 

= 9 if count ^ operand length (8/16/32) 

6. Equal/not equal cases (penalty is the same regardless of lock). 

7. Assuming that addresses for memory read (for indirection), stack push/pop, and branch fall in different cache sets. 

8. Penalty for cache miss: add 6 clocks for every 1 6 bytes copied to new stack frame. 

9. Add 1 1 clocks for each unaccessed descriptor load. 

10. Refer to task switch clock counts table for value of TS. 

1 1 . Add 4 extra clocks to the cache miss penalty for each 1 6 bytes. 
For notes 12-13: (b = 0-3, non-zero byte number); 

(i = 0-1, non-zero nibble number); 
(n = 0-3, non bit number in nibble); 

12. Clocks = 8 + 4 (b+1) + 3(i+1) + 3(n+1) 

= 6 if second operand = 

13. Clocks = 9 + 4(b+1) + 3(i + 1) + 3(n + 1) 

= 7 if second operand = 
For notes 14-15: (n = bit position 0-31) 

14. Clocks = 7 + 3(32- n) 

6 if second operand = 

15. Clocks = 8 + 3(32- n) 

7 if second operand = 

16. Assuming that the two string addresses fall in different cache sets. 

1 7. Cache miss penalty: add 6 clocks for every 1 6 bytes compared. Entire penalty on first compare. 

18. Cache miss penalty: add 2 clocks for every 16 bytes of data. Entire penalty on first load. 

1 9. Cache miss penalty: add 4 clocks for every 1 6 bytes moved. 
(1 clock for the first operation and 3 for the second) 

20. Cache miss penalty: add 4 clocks for every 16 bytes scanned. 
(2 clocks each for first and second operations) 

21 . Refer to interrupt clock counts table for value of INT 

22. Clock count includes one clock for using both displacement and immediate. 

23. Refer to assumption 6 in the case of a cache miss. 
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Table 10.2. lntel486TM Microprocessor I/O Instructions Clock Count Summary 



INSTRUCTION 


FORMAT 




Real 
Mode 


Protected 

Mode 

(CPL^IOPL) 


Protected 

Mode 

(CPL>IOPL) 


Virtual 86 
Mode 


Notes 


I/O INSTRUCTIONS 
IN = Input from: 

Fixed Port 

Variable Port 

OUT = Output to: 

Fixed Port 

Variable Port 

INS = Input Byte/Word 
from DX Port 

OUTS = Output Byte/Word 
to DX Port 

REPINS= Input String 

REPOUTS = Output String 






14 
14 

16 
16 
17 

17 

16 + 8C 

17 + 5C 


9 
8 

11 
10 
10 

10 

10 + 8C 
11+5C 


29 
28 

31 
30 
32 

32 

30 + 8C 
31+ 5c 


27 
27 

29 
29 
30 

30 

29 + 8C 

30 + 5c 


1 

2 
3 


1 11001 Ow 


port number | 






1 1 101 10w 




1 1 1 001 1 w 


port number | 






1 1 1 01 1 1 w 




01 101 lOw 




01 101 1 1w 




1 1 1 1001 1 


01 101 lOw 1 






1 1 1 1001 1 


01 101 1 1w 1 







NOTES: 

1 . Two clock cache miss penalty in all cases. 

2. c = count in CX or ECX. 

3. Cache miss penalty in all modes: Add 2 clocks for every 16 bytes. Entire penalty on second operation. 
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Table 10.3. lntel486TM Microprocessor Floating Point Clock Count Summary 



INSTRUCTION 


FORMAT 






Cache Hit 


Penalty If 
Cache Miss 


Concurrent 
Execution 


Notes 


Avg (Lower 

Range . . . 

Upper Range) 


Avg (Lower 

Range . . . 

Upper Range) 


DATA TRANSFER 

FLD = Real Load to ST(0) 

32-bit memory 

64-bit memory 
80-bit memory 
ST(i) 

FILD = Integer Load to ST(0) 

16-bit memory 

32-bit memory 
64-bit memory 
FBLD = BCD Load to ST(0) 

FST = Store Real from ST(0) 

32-bit memory 

64-bit memory 
ST(i) 

FSTP = Store Real from ST(0) and Po 

32-bit memory 

64-bit memory 
80-bit memory 
ST(i) 

FIST = Store Integer from ST(0) 

16-bit memory 

32-bit memory 

FISTP = Store Integer from ST(0) and 

16-bit memory 

32-bit memory 

64-bit memory 

FBSTP = Store BCD from 
ST(0) and Pop 

FXCH = Exchange ST(0) and ST(i) 

COMPARISON INSTRUCTIONS 
FCOM = Compare ST(0) with Real 

32-bit memory 

64-bit memory 
ST(i) 

FCOMP = Compare ST(0) with Real a 

32-bit memory 

64-bit memory 
ST(i) 








3 
3 
6 
4 

14.5(13-16) 
11.5(9-12) 
16.8(10-18) 
75(70-103) 

7 
8 
3 

7 

8 
6 
3 

33.4(29-34) 
32.4(28-34) 

33.4(29-34) 
33.4(29-34) 
33.4(29-34) 
175(172-176) 

4 

4 
4 
4 

4 
4 
4 


2 
3 

4 

2 
2 
3 

4 

2 
3 

2 
3 


4 
4(2-4) 
7.8(2-8) 
7.7(2-8) 


1 
2 

1 
2 


|l 101 1 


001 mod 000 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 mod r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 mod 101 r/m 


s-i-b/disp. 1 








|l 101 1 


01 110 ST(i) 






|l 101 1 


1 1 1 mod r/m 


s-i-b/disp. 1 








1 1 101 1 


1 1 1 mod r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 1 mod 101 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 mod 10 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 mod 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 mod 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 1 1 1 ST(i) 


p 




1 1 101 1 


1 1 mod 1 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 mod 1 1 r/m 


s-i-b/disp. 1 








1 1 101 1 


1 1 1 mod 1 1 1 r/m 


s-i-b/disp. 1 








1 1 101 1 


1 1 1 1 1 1 ST(i) 






|l 101 1 


1 1 1 1 mod 1 r/m 


s-i-b/disp. 1 








1 1 101 1 


1 1 1 mod 1 r/m 


s-i-b/disp. 1 


Pop 






|l 101 1 


1 1 1 1 mod 1 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 mod 1 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 1 mod 1 1 1 r/m 


s-i-b/disp. 1 








|l 1 01 1 


1 1 1 1 mod 1 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 1 1 ST(i) 






1 1 101 1 


1 mod 1 r/m 


s-i-b/disp. 1 








1 1 101 1 


1 1 mod 1 r/m 


s-i-b/disp. 1 


|l 101 1 


000| 11010 ST(i) 




Id Pop 




|l 101 1 


1 mod 1 1 r/m 


s-i-b/disp. 1 








|l 1 01 1 


1 1 mod 1 1 r/m 


s-i-b/disp. 1 








|l 101 1 


1 1 1 1 1 ST(i) 
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Table 10.3. lntel486TM Microprocessor Floating Point Clock Count Summary (Continued) 



INSTRUCTION FORMAT 


Cache Hit 


Penalty if 
Cache Miss 


Concurrent 
Execution 


Notes 


Avg (Lower 

Range . . . 

Upper Range) 


Avg (Lower 

Range . . . 

Upper Range) 


COMPARISON INSTRUCTIONS (Continued) 








5 

18(16-20) 
16.5(15-17) 

18(16-20) 
16.5(15-17) 

4 

4 

4 
5 
8 

4 
4 
6 
8 
8 
8 
8 

10(8-20) 
10(8-20) 
10(8-20) 
10(8-20) 

10(8-20) 
10(8-20) 
10(8-20) 

10(8-20) 


2 
2 

2 
2 

2 
3 

2 
3 


1 

2 
2 
2 
2 
2 

7(5-17) 
7(5-17) 
7(5-17) 
7(5-17) 

7(5-17) 
7(5-17) 
7(5-17) 

7(5-17) 




FCOMPP = Compare ST(0) with | 1 1 11 

ST(1) and Pop Twice 
FICOM = Compare ST(0) with Integer 


1 10 


1101 1001 1 


16-bit memory 1 11011 


1 10 


mod 1 r/m | 


s-i-b/disp. 1 






32-bit memory | 1 1 1 1 


010 


mod 1 r/m | 


s-i-b/disp. 1 


FICOMP = Compare ST(0) with integer 




16-bit memory | 11011 


1 10 


mod 1 1 r/m | 


s-i-b/disp. 1 






32-bit memory | 1 1 1 1 


010 


mod Oil r/m 1 


s-i-b/disp. 1 








FTST = Compare ST(0) with 0.0 | 1 1 1 1 


001 


1110 oioo| 






FUCOM = Unordered compare 1 1 1 1 1 


101 


1110 8T(i) 1 


ST(0)withST(i) 




FUCOMP = Unordered compare 1 1 1 1 1 


101 


11101 8T(i) 1 


ST(0) with ST(i) and Pop 




FUCOMPP = Unordered compare 1 1 1 1 1 


010 


1110 100l| 


ST(0) with ST(I) and Pop Twice 




FXAM = Examine ST(0) | 1 1 1 1 


001 


1110 010l| 


CONSTANTS 




FLDZ = Load +0.0 Into ST(0) | 1 1 1 1 


001 


1110 1 1 io| 






FLD1 = Load + 1.0 into ST(0) | 1 1 1 1 


001 


1110 iooo| 






FLDPI = Load tt Into ST(0) | 1 1 1 1 


001 


1110 101 1 1 






FLDL2T = Load iogadO) Into ST(0) | 1 1 1 1 


001 


1110 1001 1 






FLDL2E = Load iog2(e) Into ST(0) | 1 1 1 1 


001 


1110 ioio| 






FLDLG2 = Load logio(2) Into ST(0) 1 1 1 1 1 


001 


1110 1 ioo| 






FLDLN2 = Load ioge(2) into ST(0) | 1 1 1 1 


001 


1110 1 101 1 


ARITHMETIC 

FADD = Add Real with ST(0) 




ST(0) <<- ST(0) + 32-bit memory | 1 1 1 1 


000 


mod 00 r/m| 


s-i-b/disp. 1 






81(0) <(- ST(0) + 64-bit memory | 1 1 1 1 


100 


mod 000 r/m 


s-i-b/disp. 1 








ST(d) <- ST(0) + ST(i) 1 1 1 1 1 


dOO 


110 8T(i) 1 






FADDP = Add real with ST(0) and | 1 1 1 1 


1 10 


110 8T(i) 1 


Pop (ST(i) <- ST(0) + ST(I)) 
FSUB = Subtract real from ST(0) 




81(0) -<- 8T(0) - 32-bit memory | 1 1 1 1 


000 


mod 10 r/m 1 


s-i-b/disp. 1 






81(0) *- 81(0) - 64-bit memory | 1 1 1 1 


100 


mod 1 r/m | 


s-i-b/disp. 1 








8T(d) «- 8T(0) - ST(i) | 1 1 1 1 


dOO 


mod 8T(i) 1 






FSUBP = Subtract real from ST(0) | 1 1 1 1 


1 10 


11101 8T(i) 1 


and Pop (ST(I) <- ST(0) - ST(I)) 
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Table 10.3. lntel486TM Microprocessor Floating Point Ciocl( Count Summary (Continued) 



INSTRUCTION FORMAT 


Cache Hit 


Penalty if 
Cache Miss 


Concurrent 
Execution 


Notes 


Avg (Lower 

Range . . . 

Upper Range) 


Avg (Lower 

Range . . . 

Upper Range) 


ARITHMETIC (Continued) 

FSUBR = Subtract real reversed (Subtract ST(0) from real) 


10(8-20) 
10(8-20) 
10(8-20) 
10(8-20) 

11 
14 
16 
16 

73 
73 
73 
73 

73 
73 
73 
73 

24(20-35) 
22.5(19-32) 

24(20-35) 
22.5(19-32) 

24(20-35) 
22.5(19-32) 

25(23-27) 
23.5(22-24) 

87(85-89) 
85.5(84-86) 


2 
3 

2 
3 

2 

3 

2 
3 

2 
2 

2 
2 

2 
2 

2 
2 

2 
2 


7(5-17) 
7(5-17) 
7(5-17) 
7(5-17) 

8 
11 
13 
13 

70 
70 
70 
70 

70 
70 
70 
70 

7(5-17) 
7(5-17) 

7(5-17) 
7(5-17) 

7(5-17) 
7(5-17) 

8 
8 

70 
70 


3 
3 
3 
3 

3 
3 
3 
3 

3 
3 


ST(0) <- 32-bit memory - ST(0) 1 11 1 1 


O0o|mod 101 


r/m 


s-i-b/disp. 1 






ST(0) -*- 64-bit memory - ST(0) | 1 1 1 1 


10 mod 1 1 


r/m 


s-i-b/disp. 1 






ST(d) «- ST(i) - ST(0) | 1 1 1 1 


dOo|l 1 10d 


81(1) 




FSUBRP = Subtract real reversed 1 1 1 1 1 


110 11100 


8T(I) 


and Pop (ST(I) <- ST(I) - ST(0)) 
FMUL = Multiply real with ST(0) 


ST(0) <— ST(0) X 32-bit memory 1 1 1 1 1 


OOolmod 001 


r/m 


s-i-b/disp. 1 






ST(0) <- ST(0) X 64-bit memory 1 1 1 1 1 


10o|mod 001 


r/m 


s-i-b/disp. 1 






ST(d) «<- ST(0) X ST(i) | 1 1 1 1 


dOo|l 1001 


8T(i) 




FMULP = Multiply ST(0) with ST(i) 1 1 1 1 1 


1 1o|l 1001 


8T(i) 


and Pop (ST(I) <- ST(0) x ST(i)) 
FDIV = Divide ST(0) by Real 


ST(0) <- ST(0)/32-bit memory 1 1 1 1 1 


1 mod 110 


r/m 


s-i-b/disp. 1 






ST(0) <- ST(0)/64-bit memory 1 1 1 1 1 


1 1 mod 110 


r/m 


s-i-b/disp. I 






ST(d) <- ST(0)/ST(i) | 1 1 1 1 


dOo|l 1 1 Id 


8T(i) 




FDIVP = Divide ST(0) by ST(i) and | 1 1 1 1 


1 io|i 1 1 1 1 


8T(i) 


Pop(ST(l)^ST(0)/ST(l)) 
FDIVR = Divide real reversed (Real/ST(0)) 


81(0) «- 32-bit memory/ST(0) | 1 1 1 1 


1 mod 1 1 1 


r/m 


s-i-b/disp. 1 






ST(0) 4- 64-bit memory/ST(0) | 1 1 1 1 


1 1 mod 1 1 1 


r/m 


s-i-b/disp. 1 






ST(d) ^ ST(i)/ST(0) 1 1 1 1 1 


dOo|l 1 1 Id 


8T(i) 


FDIVRP = Divide real reversed and 1 1 1 1 1 


1 io|i 1 1 10 


ST(i) 


Pop(ST(l)<-ST(l)/ST(0)) 
FIADD = Add Integer to ST(0) 


ST(0) *- 81(0) + 16-bit memory 1 1 1 1 1 


1 1 1 mod 


r/m 


s-i-b/disp. 1 






81(0) <- 8T(0) + 32-bit memory | 1 1 1 1 


01o|mod 00 


r/m 


s-i-b/disp. 1 


FISUB = Subtract Integer from ST(0) 




8T(0) *- 81(0) - 16-bit memory 1 1 1 1 1 


1 1 1 mod 10 


r/m 


s-i-b/disp. \ 






ST(0) <^ 8T(0) - 32-bit memory 1 1 1 1 1 


1 1 mod 10 


r/m 


s-i-b/disp. 1 


FISUBR = Integer Subtract Reversed 




ST(0) <- 16-bit memory - ST(0) 1 1 1 1 1 


1 1 1 mod 1 1 


r/m 


s-i-b/disp. 1 






81(0) <- 32-bit memory - 81(0) | 1 1 1 1 


1 1 mod 101 


r/m 


s-i-b/disp. 1 


FIMUL = Multiply Integer with ST(0) 




8T(0) <- 81(0) X 16-bit memory 1 1 1 1 1 


1 1 1 mod 1 


r/m 


s-i-b/disp. 1 






81(0) <- 81(0) X 32-bit memory | 1 1 1 1 


1 1 mod 1 


r/m 


s-i-b/disp. 1 


FIDIV= Integer Divide 




8T(0) ^ 81(0)/ 16-bit memory | 1 1 1 1 


1 1 1 mod 1 1 


r/m 


s-i-b/disp. 1 






81(0) *- 8T(0)/32-bit memory | 1 1 1 1 


1 1 mod 1 1 


r/m 


s-i-b/disp. 1 
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Table 10.3. lntel486TM Microprocessor Floating Point Clock Count Summary (Continued) 



INSTRUCTION 



Cache Hit 



Avg (Lower 

Range . . . 

Upper Range) 



Penalty If 
Cache Miss 



Concurrent 
Execution 



Avg (Lower 

Range... 

Upper Range) 



ARITHMETIC (Continued) 

FIDIVR = Integer Divide Reversed 

ST(0) <- 16-bit memory/ST(0) 

ST(0) -*- 32-bit memory/ST(0) 

FSQRT = Square Root 

FSCALE = Scale ST(0) by ST(1) 

FXTRACT = Extract components 
of ST(0) 

FPREM = Partial Reminder 

FPREM1 = Partial Reminder (IEEE) 

FRNDINT = Round ST(0) to Integer 

FABS = Absolute value of ST(0) 

FCHS = Change sign of ST(0) 

TRANSCENDENTAL 
FCOS = Cosine of ST(0) 

FPTAN = Partial tangent of ST(0) 

FPATAN = Partial arctangent 

FSIN = Sine of ST(0) 

FSINCOS = Sine and cosine of ST(0) 

F2XM1 = 2S^<°) - 1 

FYL2X = ST(1) X log2(ST(0)) 

FYL2XP1 = ST(1) X log2(ST(0) + 1.0) 

PROCESSOR CONTROL 

FINIT = Initialize FPU 

FSTSW AX = Store status word 
into AX 

FSTSW = Store status word 
into memory 

FLDCW = Load control word 

FSTCW = Store control word 

FCLEX = Clear exceptions 

FSTENV = Store environment 

Real and Virtual modes 16-bit Address 
Real and Virtual modes 32-bit Address 
Protected mode 16-bit Address 
Protected mode 32-bit Address 



1 1 1 1 1 1 1 1 mod 1 1 1 r/m 1 s-i-b/disp. | 




1 1 1 1 1 1 1 mod 1 1 1 r/m 1 s-i-b/disp. | 




|l 101 1 00l|l 1 1 1 ioio| 




|l 101 1 00l| 1 1 1 1 1 10l| 




|i 101 1 001 1 1 1 1 01 oo| 




|i 101 1 ooi|i 1 1 1 iooo| 




|l 101 1 001 |l 1 1 1 010l| 




1 1 101 1 ooi|i 1 1 1 1 ioo| 




|l 101 1 00l|l 1 10 000l| 




|i 101 1 001 |i 1 10 oooo| 




1 1 101 1 001 |l 1 1 1 1 1 1 l| 




|i 101 1 001 |i 1 1 1 ooio| 




|l 101 1 001 |l 1 1 1 001 1 1 




|i 101 1 001 |i 1 1 1 1 1 io| 




|l 101 1 001 |l 1 1 1 101 1 1 




|i 101 1 001 1 1 1 1 1 oooo| 




|l 101 1 001 1 1 1 1 1 0001 1 




|l 101 1 00l| 1 1 1 1 1001 1 




1 1 1 01 1 01 1 1 1 1 1 001 1 1 




|i 101 1 1 1 1| 1 1 10 oooo| 




1 1 1 1 1 1 1 1 mod 1 1 1 r/m 1 s-i-b/disp. | 




1 1 1 1 1 1 1 mod 1 1 r/m 1 s-i-b/disp. | 




1 1 1 1 1 1 1 mod 1 1 1 r/m 1 s-i-b/disp. | 




|l 101 1 01 l|l 1 10 ooio| 




1 1 1 1 1 1 1 mod 1 1 r/m 1 s-i-b/disp. | 



Real and Virtual modes 16-bit Address 
Real and Virtual modes 32-bit Address 
Protected mode 16-bit Address 
Protected mode 32-bit Address 



87(85-89) 


2 


85.5(84-86) 


2 


85.5(83-87) 




31(30-32) 




19(16-20) 




84(70-138) 




94.5(72-167) 




29.1(21-30) 




3 




6 




241(193-279) 




244(200-273) 




289(218-303) 




241(193-279) 




291(243-329) 




242(140-279) 




311(196-329) 




313(171-326) 




17 




3 





FLDENV = Load environment | 1 1 1 1 1 | mod 1 r/m | s-i-b/disp. | 



4 


2 


3 




7 




67 




67 




56 




56 




44 


2 


44 


2 


34 


2 


34 


2 



70 
70 
70 
2 
4(2-4) 

2(2-8) 
5.5(2-18) 
7.4(2-8) 



2 


6.7 


70 


6.7 


2-17) 


6 


2 


6.7 


2 


6.7 


2 


6 


13 


6 


13 


6 




4 




5 



165 



Intel. 



lntel486TM DX MICROPROCESSOR 



IPI^iyiMlDMAI^V 



Table 10.3. lntel486TM Microprocessor Floating Point Clock Count Summary (Continued) 



INSTRUCTION FORMAT 


Cache Hit 


Penalty If 
Cache Miss 


Concurrent 
Execution 


Notes 


Avg (Lower 

Range . . . 

Upper Range) 


Avg (Lower 

Range . . . 

Upper Range) 


PROCESSOR CONTROL (Continued) 


154 
154 
143 
143 

131 
131 
120 
120 

3 

3 

3 

3 

1/3 


23 
27 
23 
27 




4 
4 
4 
4 


FSAVE = Save state 1 1 1 1 1 1 1 | mod 1 1 r/m | s-i-b/disp. | 
Real and Virtual modes 16-bit Address 
Real and Virtual modes 32-bit Address 
Protected mode 16-bit Address 
Protected mode 32-bit Address 


FRSTOR = Restore state 1 1 1 1 1 1 1 1 mod 1 r/m | s-i-b/ | 
Real and Virtual modes 16-bit Address 
Real and Virtual modes 32-bit Address 
Protected mode 16-bit Address 
Protected mode 32-bit Address 


FINCSTP = Increment Stack Pointer |l1011 00l|l111011l| 


FDECSTP = Decrement Stack Pointer |l1011 0011111 011o| 


FFREE = Free ST(l) |l1011 101 11000 ST(i) | 


FNOP = No operations |l1011 00l|l101 OOOo| 


WAIT = Walt until FPU ready | 10 011011 


(Minimum/Maximum) 



NOTES: 

1 . If operand Is clock counts = 27, 

2. If operand Is clock counts = 28. 

3. If CW.PC indicates 24 bit precision then subtract 38 clocks. 
If CW.PC Indicates 53 bit precision then subtract 1 1 clocks. 

4. If there is a numeric error pending from a previous Instruction add 1 7 clocks. 

5. If there Is a numeric error pending from a previous instruction add 1 8 clocks. 

6. The INT pin is polled several times while this instruction is executing to assure short interrupt latency. 

7. If ABS(operand) is greater than 7r/4 then add n clocks. Where n = (operand/(7r/4)). 
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10.2 Instruction Encoding 

10.2.1 OVERVIEW 

All instruction encodings are subsets of the general 
instruction format shown in Figure 10.1. Instructions 
consist of one or two primary opcode bytes, possibly 
an address specifier consisting of the "mod r/m" 
byte and "scaled index" byte, a displacement if re- 
quired, and an immediate data field if required. 

Within the primary opcode or opcodes, smaller en- 
coding fields may be defined. These fields vary ac- 
cording to the class of operation. The fields define 
such information as direction of the operation, size 
of the displacements, register encoding, or sign ex- 
tension. 

Almost all instructions referring to an operand in 
memory have an addressing mode byte following 
the primary opcode byte(s). This byte, the mod r/m 
byte, specifies the address mode to be used. Certain 
encodings of the mod r/m byte indicate a second 



addressing byte, the scale-index-base byte, follows 
the mod r/m byte to fully specify the addressing 
mode. 

Addressing modes can include a displacement im- 
mediately following the mod r/m byte, or scaled in- 
dex byte. If a displacement is present, the possible 
sizes are 8, 1 6 or 32 bits. 

If the instruction specifies an immediate operand, 
the immediate operand follows any displacement 
bytes. The immediate operand, if specified, is always 
the last field of the instruction. 

Figure 10.1 illustrates several of the fields that can 
appear in an instruction, such as the mod field and 
the r/m field, but the Figure does not show all fields. 
Several smaller fields also appear in certain instruc- 
tions, sometimes within the opcode bytes them- 
selves. Table 10.4 is a complete list of all fields ap- 
pearing In the Intel486 Microprocessor Instruction 
set. Further ahead, following Table 10.4, are de- 
tailed tables for each field. 



TTTTTTTT TTTTTTTT modTTTr/m ssindexbase d32 | 16 | 8 | nonedata32 | 16 | 8 | none 



7 
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opcode 

(one or two bytes) 

(T represents an 

opcode bit.) 



"mod r/m" 
byte 



"s-i-b" 
byte 



register and address 
mode specifier 



address 
displacement 
(4, 2, 1 bytes 

or none) 



J \^ 



immediate 

data 

(4, 2, 1 bytes 

or none) 



Figure 10.1. General Instruction Format 



Table 10.4. Fields within lntel486TM Microprocessor Instructions 



Field Name 


Description 


Number of Bits 


w 


Specifies if Data is Byte or Full Size (Full Size is either 16 or 32 Bits 


1 


d 


Specifies Direction of Data Operation 


1 


s 


Specifies if an Immediate Data Field Must be Sign-Extended 


1 


reg 


General Register Specifier 


3 


mod r/m 


Address Mode Specifier (Effective Address can be a General Register) 


2 for mod; 
3 for r/m 


ss 


Scale Factor for Scaled Index Address Mode 


2 


index 


General Register to be used as Index Register 


3 


base 


General Register to be used as Base Register 


3 


sreg2 


Segment Register Specifier for CS, SS, DS, ES 


2 


sreg3 


Segment Register Specifier for CS, SS, DS, ES, FS, GS 


3 


tttn 


For Conditional Instructions, Specifies a Condition Asserted 






or a Condition Negated 


4 



NOTE: 

Tables 10.1-10.3 show encoding of individual instructions. 
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10.2.2 32-BIT EXTENSIONS OF THE 
INSTRUCTION SET 

With the Intel486 Microprocessor, the 8086/80186/ 
80286 instruction set is extended in two orthogonal 
directions: 32-bit forms of all 1 6-bit instructions are 
added to support the 32-bit data types, and 32-bit 
addressing modes are made available for all instruc- 
tions referencing memory. This orthogonal instruc- 
tion set extension is accomplished having a Default 
(D) bit in the code segment descriptor, and by hav- 
ing 2 prefixes to the instruction set. 

Whether the instruction defaults to operations of 1 6 
bits or 32 bits depends on the setting of the D bit in 
the code segment descriptor, which gives the de- 
fault length (either 32 bits or 16 bits) for both oper- 
ands and effective addresses when executing that 
code segment. In the Real Address Mode or Virtual 
8086 Mode, no code segment descriptors are used, 
but a D value of Is assumed Internally by the in- 
tel486 Microprocessor when operating in those 
modes (for 16-bit default sizes compatible with the 
8086/80186/80286). 

Two prefixes, the Operand Size Prefix and the Effec- 
tive Address Size Prefix, allow overriding individually 
the Default selection of operand size and effective 
address size. These prefixes may precede any op- 
code bytes and affect only the instruction they pre- 
cede. If necessary, one or both of the prefixes may 
be placed before the opcode bytes. The presence of 
the Operand Size Prefix and the Effective Address 
Prefix will toggle the operand size or the effective 
address size, respectively, to the value "opposite" 
from the Default setting. For example. If the default 
operand size is for 32-bit data operations, then pres- 
ence of the Operand Size Prefix toggles the Instruc- 
tion to 1 6-bit data operation. As another example, if 
the default effective address size Is 16 bits, pres- 
ence of the Effective Address Size prefix toggles the 
instruction to use 32-blt effective address computa- 
tions. 

These 32-bit extensions are available in all Intel486 
Microprocessor modes, including the Real Address 
Mode or the Virtual 8086 Mode. In these modes the 
default is always 16 bits, so prefixes are needed to 
specify 32-blt operands or addresses. For Instruc- 
tions with more than one prefix, the order of prefixes 
is unimportant. 

Unless specified otherwise, instructions with 8-bit 
and 16-blt operands do not affect the contents of 
the high-order bits of the extended registers. 



10.2.3 ENCODING OF INTEGER 
INSTRUCTION FIELDS 

Within the instruction are several fields indicating 
register selection, addressing mode and so on. The 
exact encodings of these fields are defined immedi- 
ately ahead. 

10.2.3.1 Encoding of Operand Length (w) Field 

For any given instruction performing a data opera- 
tion, the instruction is executing as a 32-bit operation 
or a 16-bit operation. Within the constraints of the 
operation size, the w field encodes the operand size 
as either one byte or the full operation size, as 
shown in the table below. 



w Field 


Operand Size 

During 16-Bit 

Data Operations 


Operand Size 

During 32-Bit 

Data Operations 



1 


8 Bits 
16 Bits 


8 Bits 
32 Bits 



10.2.3.2 Encoding of the General 
Register (reg) Field 

The general register is specified by the reg field, 
which may appear in the primary opcode bytes, or as 
the reg field of the "mod r/m" byte, or as the r/m 
field of the "mod r/m" byte. 

Encoding of reg Field When w Field 
is not Present in Instruction 





Register Selected 


Register Selected 


reg Field 


During 16-Bit 


During 32-Bit 




Data Operations 


Data Operations 


000 


AX 


EAX 


001 


CX 


ECX 


010 


DX 


EDX 


oil 


BX 


EBX 


100 


SP 


ESP 


101 


BP 


EBP 


110 


SI 


ESI 


111 


Dl 


EDI 
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Encoding of reg Field When w Field 
is Present in Instruction 



1 


Register Specified by reg Field 




During 16-Bit Data Operations: 


reg 


Function of w Field 


(when w = 0) 


(when w = 1) 


000 


AL 


AX 


001 


CL 


CX 


010 


DL 


DX 


oil 


BL 


BX 


100 


AH 


8P 


101 


CH 


BP 


110 


DH 


81 


111 


BH 


Dl 



Register Specified by reg Field 
During 32-Bit Data Operations 


reg 


Function of w Field 


(when w = 0) 


(when w = 1) 


000 
001 
010 

oil 

100 
101 
110 

111 


AL 
CL 
DL 
BL 
AH 
CH 
DH 
BH 


EAX 
ECX 
EDX 
EBX 
ESP 
EBP 
ESI 
EDI 



10.2.3.3 Encoding of the Segment 
Register (sreg) Field 

The sreg field in certain instructions is a 2-bit field 
allowing one of the four 80286 segment registers to 
be specified. The sreg field In other instructions is a 
3-bit field, allowing the Intel486 Microprocessor FS 
and GS segment registers to be specified. 

2-Bit sreg2 Field 



2-Bit 
sreg2 Field 


Segment 
Register 
Selected 


00 
01 
10 

11 


ES 
CS 
SS 
DS 



3-Bit sreg3 Field 


3-Bit 
sreg3 Field 


Segment 
Register 
Selected 


000 


ES 


001 


CS 


010 


SS 


oil 


DS 


100 


FS 


101 


GS 


110 


do not use 


111 


do not use 



10.2.3.4 Encoding of Address Mode 

Except for special instructions, such as PUSH or 
POP, where the addressing mode is pre-determined, 
the addressing mode for the current instruction Is 
specified by addressing bytes following the primary 
opcode. The primary addressing byte is the "mod 
r/m" byte, ancJ a second byte of addressing informa- 
tion, the "s-i-b" (scale-index-base) byte, can be 
specified. 

The s-i-b byte (scale-index-base byte) is specified 
when using 32-bit addressing mode and the "mod 
r/m" byte has r/m = 100 and mod = 00, 01 or 10. 
When the sib byte is present, the 32-bit addressing 
mode is a function of the mod, ss, index, and base 
fields. 

The primary addressing byte, the "mod r/m" byte, 
also contains three bits (shown as TTT in Figure 
10.1) sometimes used as an extension of the pri- 
mary opcode. The three bits, however, may also be 
used as a register field (reg). 

When calculating an effective address, either 16-bit 
addressing or 32-bit addressing is used. 16-bit ad- 
dressing uses 16-bit address components to calcu- 
late the effective address while 32-bit addressing 
uses 32-bit address components to calculate the ef- 
fective address. When 1 6-bit addressing Is used, the 
"mod r/m" byte is interpreted as a 16-bit addressing 
mode specifier. When 32-bit addressing is used, the 
"mod r/m" byte is interpreted as a 32-bit addressing 
mode specifier. 

Tables on the following three pages define all en- 
codings of all 16-bit addressing modes and 32-bit 
addressing modes. 
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Encoding of 16-bit Address l\/lode with "mod r/m" Byte 



mod r/m 


Effective Address 


00 000 


DS:[BX + SI] 


00 001 


DS:[BX + DI] 


00 010 


SS:[BP + SI1 


00 011 


SS:[BP + DI] 


00100 


DS:[SI] 


00101 


DS:[DI] 


00 110 


DS:d16 


00111 


DS:[BX] 


01000 


DS:[BX+SI + d8] 


01001 


DS:[BX + DI + d8] 


01 010 


SS:[BP + SI + d8] 


01011 


SS:[BP + DI + d8] 


01 100 


DS:[SI + d8] 


01 101 


DS:[DI + d8] 


01 110 


SS:[BP + d8] 


01 111 


DS:[BX + d8] 



mod r/m 


Effective Address 


10 000 


DS:[BX + SI + d16] 


10 001 


DS:[BX + DI + d16] 


10010 


SS:[BP + SI + d16] 


10011 


SS:[BP + DI + d16] 


10 100 


DS:[SH-d16] 


10 101 


DS:[DI + d16] 


10110 


SS:[BP + d16] 


10111 


DS:[BX + d16] 


11 000 


register— see below 


11 001 


register— see below 


11010 


register— see below 


11011 


register— see below 


11 100 


register— see below 


11 101 


register— see below 


11 110 


register— see below 


11 111 


register — see below 



Register Specified by r/m 
During 16-Bit Data Operations 


mod r/m 


Function of w Field 


(when w=0) 


(whenw =1) 


11000 
11001 
11010 
11 011 
11 100 
11 101 
11 110 

11 111 


AL 
CL 
DL 
BL 
AH 
CH 
DH 
BH 


AX 
CX 
DX 
BX 
SP 
BP 
SI 
Dl 



Register Specified by r/m 
During 32-Bit Data Operations 


mod r/m 


Function of w Field 


(whenw = 0) 


(when w = 1) 


11000 
11 001 
11 010 
11011 
11 100 
11 101 
11 110 

11 111 


AL 
CL 
DL 
BL 
AH 
CH 
DH 
BH 


EAX 
ECX 
EDX 
EBX 
ESP 
EBP 
ESI 
EDI 
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Encoding of 32-bit Address Mode with "mod r/m" byte (no "s-i-b" byte present): 



mod r/m 


Effective Address 


00 000 


DS:[EAX] 


00 001 


DS:[ECX1 


00 010 


DS:[EDX] 


00 011 


DS:[EBX1 


00 100 


s-i-b is present 


00 101 


DS:d32 


00 110 


DS:[ESI] 


00111 


DS:[EDI1 


01 000 


DS:[EAX+d8] 


01001 


DS:[ECX + d8] 


01010 


DS:[EDX + d8] 


01011 


DS:[EBX + d8] 


01 100 


s-i-b is present 


01 101 


SS:[EBP + d8] 


01 110 


DS:[ESI + d8] 


01 111 


DS:[EDI + d8] 



mod r/m 


Effective Address 


10 000 


DS:[EAX + d32] 


10 001 


DS:[ECX + d32] 


10010 


DS:[EDX + d32] 


10011 


DS:[EBX + d32] 


10100 


s-i-b is present 


10101 


SS:[EBP + d32] 


10110 


DS:[ESI + d32] 


10111 


DS:[EDI + d32l 


11 000 


register— see below 


11001 


register— see below 


11010 


register— see below 


11011 


register— see below 


11 100 


register— see below 


11 101 


register— see below 


11 110 


register— see below 


11 111 


register — see below 



Register Specified by reg or r/m 
during 16-Bit Data Operations: 


mod r/m 


Function of w field 


(when w==0) 


(whenw=1) 


11 000 
11 001 
11010 
11011 
11 100 
11 101 
11 110 

11 111 


AL 
CL 
DL 
BL 
AH 
CH 
DH 
BH 


AX 
CX 
DX 
BX 
SP 
BP 
SI 
Dl 



Register Specified by reg or r/m 
during 32-Bit Data Operations: 


mod r/m 


Function of w field 


(when w=0) 


(whenw=1) 


11 000 
11001 
11010 
11011 
11 100 
11 101 
11 110 

11 111 


AL 
CL 
DL 
BL 
AH 
CH 
DH 
BH 


EAX 
ECX 
EDX 
EBX 
ESP 
EBP 
ESI 
EDI 
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Encoding of 32-blt Address Mode ("mod r/m" byte and "s-l-b" byte present): 



mod base 


Effective Address 


00 000 
00 001 
00 010 
00 011 
00 100 
00 101 

00 110 
00111 

01 000 
01001 
01010 
01011 
01 100 
01 101 
01 110 
01 111 

10 000 
10 001 
10010 
10011 
10 100 
10101 
10110 
10111 


DS: [EAX + (scaled index)] 
DS: [ECX + (scaled index)] 
DS: [EDX + (scaled index)] 
DS:[EBX+ (scaled index)] 
SS: [ESP + (scaled index)] 
DS: [d32 + (scaled index)] 
DS: [ESI + (scaled index)] 
DS: [EDI + (scaled index)] 

DS: [EAX + (scaled index) + d8] 
DS: [ECX + (scaled index) + d8] 
DS: [EDX + (scaled index) + d8] 
DS: [EBX + (scaled index) + d8] 
SS: [ESP + (scaled index) + d8] 
SS: [EBP + (scaled index) + d8] 
DS: [ESI + (scaled index) + d8] 
DS: [EDI + (scaled index) + d8] 

DS: [EAX + (scaled index) + d32] 
DS: [ECX + (scaled index) + d32] 
DS: [EDX + (scaled index) + d32] 
DS: [EBX + (scaled index) + d32] 
SS: [ESP + (scaled index) + d32] 
SS: [EBP + (scaled index) + d32] 
DS: [ESI + (scaled index) + d32] 
DS: [EDI + (scaled index) + d32] 



NOTE: 

Mod field in 
"s-i-b" byte. 



00 
01 
10 
11 



Scale Factor 



x1 
x2 
x4 
x8 



Index 


Index Register 


000 


EAX 


001 


ECX 


010 


EDX 


oil 


EBX 


100 


no index reg** 


101 


EBP 


110 


ESI 


111 


EDI 



♦♦IMPORTANT NOTE: 

When index field is 100, indicating "no index register," then 
SS field MUST equal GO. If index is 100 and ss does not 
equal GO, the effective address is undefined. 



'mod r/m" byte; ss, index, base fields in 
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10.2.3.5 Encoding of Operation 
Direction (d) Field 

In many two-operand instructions the d field is pres- 
ent to indicate which operand is considered the 
source and which is the destination. 



Direction of Operation 



Register/ Memory <- - Register 
"reg" Field Indicates Source Operand; 
"mod r/m" or "mod ss index base" Indicates 
Destination Operand 



Register <- - Register/Memory 
"reg" Field Indicates Destination Operand; 
"mod r/m" or "mod ss Index base" Indicates 
Source Operand 



10.2.3.6 Encoding of Sign-Extend (s) Fieid 

The s field occurs primarily to instructions with im- 
mediate data fields. The s field has an effect only if 
the size of the immediate data is 8 bits and is being 
placed in a 1 6-bit or 32-bit destination. 



s 


Effect on 

Immediate 

DataS 


Effect on 
Immediate 
Data 16|32 



1 


None 

Sign-Extend DataS to Fill 
1 6-Bit or 32-Bit Destination 


None 
None 



10.2.3.7 Encoding of Conditional 
Test (tttn) Field 

For the conditional instructions (conditional jumps 
and set on condition), tttn Is encoded with n indicat- 
ing to use the condition (n = 0) or its negation (n= 1), 
and ttt giving the condition to test. 



Mnemonic 


Condition 


tttn 





Overflow 


0000 


NO 


No Overflow 


0001 


B/NAE 


Below/Not Above or Equal 


0010 


NB/AE 


Not Below/ Above or Equal 


0011 


E/Z 


Equal/Zero 


0100 


NE/NZ 


Not Equal/Not Zero 


0101 


BE/NA 


Below or Equal/Not Above 


0110 


NBE/A 


Not Below or Equal/Above 


0111 


S 


Sign 


1000 


NS 


Not Sign 


1001 


P/PE 


Parity/ Parity Even 


1010 


NP/PO 


Not Parity/Parity Odd 


1011 


L/NGE 


Less Than/Not Greater or Equal 


1100 


NL/GE 


Not Less Than/Greater or Equal 


1101 


LE/NG 


Less Than or Equal/Greater Than 


1110 


NLE/G 


Not Less or Equal/Greater Than 


1111 



10.2.3.8 Encoding of Control or Debug 
or Test Register (eee) Field 

For the loading and storing of the Control, Debug 
and Test registers. 

When Interpreted as Control Register Field 



eee Code 


Reg Name 


000 
010 
011 


CRO 
CR2 
CR3 


Do not use any other encoding 



When Interpreted as Debug Register Field 



eee Code 


Reg Name 


000 


DRO 


001 


DR1 


010 


DR2 


011 


DR3 


110 


DR6 


111 


DR7 


Do not use any other encoding 



When Interpreted as Test Register Field 



eee Code 


Reg Name 


011 


TR3 


100 


TR4 


101 


TR5 


110 


TR6 


111 


TR7 


Do not use any other encoding 
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Instruction 


Optional 


First Byte 


Second Byte 


Fields 


11011 


OPA 


1 


mod 


1 


OPB 


r/m 


s-i-b 


disp 


11011 


MF 


OPA 


mod 


OPB 


r/m 


s-i-b 


disp 


11011 


d 


P 


OPA 


1 


1 


OPB 


ST(i) 




11011 








1 


1 


1 


1 


OP 




11011 





1 


1 


1 


1 


1 


OP 





15-11 



10 



10.2.4 ENCODING OF FLOATING POINT 
INSTRUCTION FIELDS 

Instructions for the FPU assume one of the five 
forms shown in the following table. In all cases, in- 
structions are at least two bytes long and begin with 
the bit pattern 11 01 IB. 

OP = Instruction opcode, possible split into two 
fields OPA and OPB 

MF = Memory Format 
00— 32-bit real 
01— 32-bit integer 
10— 64-bit real 
11 — 16-bit integer 

P = Pop 

— Do not pop stack 

1— Pop stack after operation 



6 5 4 3 2 10 

d = Destination 

0— Destination is 81(0) 
1 — Destination is ST(i) 

R XOR d = 0— Destination (op) Source 
R XOR d = 1— Source (op) Destination 

ST(i) = Register stack element / 

000 = Stack top 

001 = Second stack element 



111= Eighth stack element 

mod (Mode field) and r/m (Register/Memory specifi- 
er) have the same interpretation as the correspond- 
ing fields of the integer instructions. 

s-i-b (Scale Index Base) byte and disp (displace- 
ment) are optionally present in instructions that have 
mod and r/m fields. Their presence depends on the 
values of mod and r/m, as for integer instructions. 
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11.0 DIFFERENCES BETWEEN THE 
lntel486TM MICROPROCESSOR 
AND THE 386TM 
MICROPROCESSOR PLUS THE 
387TM MATH COPROCESSOR 
EXTENSION 

The differences between the Intel486 Microproces- 
sor and the 386 Microprocessor are due to perform- 
ance enhancements. The differences between the 
microprocessors are listed below. 

1. Instruction clock counts have been reduced to 
achieve higher performance. See Section 10. 

2. The Intel486 Microprocessor bus is significantly 
faster than the 386 Microprocessor bus. Differ- 
ences Include a 1X clock, parity support, burst 
cycles, cacheable cycles, cache invalidate cycles 
and 8-bit bus support. The Hardware Interface 
and Bus Operation Sections (Sections 6 and 7) of 
the data sheet should be carefully read to under- 
stand the Intel486 Microprocessor bus function- 
ality. 

3. To support the on-chip cache new bits have been 
added to control register (CD and NW) (Section 
2.1.2.1), new pins have been added to the bus 
(Section 6) and new bus cycle types have been 
added (Section 7). The on-chip cache needs to 
be enabled after reset by clearing the CD and 
NW bit in CRO. 

4. The complete 387 math coprocessor instruction 
set and register set have been added. No I/O 
cycles are performed during Floating Point in- 
structions. The instruction and data pointers are 
set to after FINIT/FSAVE. Interrupt 9 can no 
longer occur, interrupt 1 3 occurs instead. 

5. The Intel486 Microprocessor supports new float- 
ing point error reporting modes to guarantee 
DOS compatibility. These new modes required a 
new bit in control register (NE) (Section 2.1.2.1) 
and new pins (FERR# and IGNNE#) (Section 
6.2.13 and 7.2.14). 

6. In some cases FERR# is asserted when the next 
floating point instruction is encountered and In 
other cases it is asserted before the next floating 
point instruction is encountered, depending upon 



the execution state the instruction causing ex- 
ception (see Sections 6.2.13 and 7.2.14). For 
both of these cases, the 387 Math Coprocessor 
asserts ERROR # when the error occurs and 
does not wait for the next floating point instruc- 
tion to be encountered. 

7. Six new instructions have been added: 
Byte Swap (BSWAP) 
Exchange-and-Add (XADD) 
Compare and Exchange (CMPXCHG) 
Invalidate Data Cache (INVD) 

Write-back and Invalidate Data Cache 
(WBINVD) 

Invalidate TLB Entry (INVLPG) 

8. There are two new bits defined in control regis- 
ter 3, the page table entries and page directory 
entries (PCD and PWT) (Section 4.5.2.5). 

9. A new page protection feature has been added. 
This feature required a new bit in control register 
(WP) (Section 2.1.2.1 and 4.5.3). 

10. A new Alignment Check feature has been add- 
ed. This feature required a new bit in the flags 
register (AC) (Section 2.1.1.3) and a new bit in 
control register (AM) (Section 2.1.2.1). 

11. The replacement algorithm for the translation 
lookaside buffer has been changed from a ran- 
dom algorithm to a pseudo least recently used 
algorithm like that used by the on-chip cache. 
See Section 5.5 for a description of the algo- 
rithm. 

12. Three new testability registers, TR3, TR4 and 
TR5, have been added for testing the on-chip 
cache. TLB testability has been enhanced. See 
Section 8. 

1 3. The prefetch queue has been increased from 1 6 
bytes to 32 bytes. A jump always needs to exe- 
cute after modifying code to guarantee correct 
execution of the new instruction. 

14. After reset, the ID in the upper byte of the DX 
register is 04. The contents of the base regis- 
ters including the floating point registers may be 
different after reset. 
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12.0 OVERDRIVE PROCESSOR 
SOCKET 

Inclusion of the OverDrive Processor Socket in sys- 
tems based on Intel486 DX Microprocessors pro- 
vides the end-user with an easy and cost-effective 
way to increase system performance. The paradigm 
of simply installing an additional component into an 
empty OverDrive Processor Socket to achieve en- 
hanced system performance is familiar to the mil- 
lions of end-users and dealers who have purchased 
Intel Math Coprocessor upgrades to boost system 
floating point performance. The OverDrive Proces- 
sor provides an overall performance increase for 
systems based on Intel486 DX Microprocessors. 

As a new system architectural feature, the provision 
of the OverDrive Processor Socket as a means for 
PC users to take advantage of the ever more rapid 
advances in software and hardware technology will 
help to maintain the competitiveness of X86 PC- 
compatible systems over other architectures into the 
future. 

The majority of upgrade installations which take ad- 
vantage of the OverDrive Processor Socket will be 
performed by end-users and resellers. Therefore, it 
is important that the design be "end-user easy", and 
that the amount of training and technical expertise 
required to install the OverDrive Processor be mini- 
mized. Upgrade installation instructions should be 
clearly described in the system user's manual. In ad- 
dition, by making installation simple and foolproof, 
PC manufacturers can reduce the risk of system 
damage, warranty claims and service calls. Feed- 
back from Intel's Math Coprocessor customers high- 
lights three main characteristics of end-user easy 
designs: accessible OverDrive Processor Socket lo- 
cation, clear indication of component orientation, 
and minimization of insertion force. 

OverDrive Processor Socket Location: The Over- 
Drive Processor Socket for Intel486 DX and Intel486 
SX Microprocessor based systems is an empty 
socket which can be located on either the mother- 
board or modular CPU card. The OverDrive Proces- 
sor Socket should be easily accessible for installa- 
tion and readily visible when the PC case is re- 
moved. The OverDrive Processor Socket should not 
be located in a position that requires removal of any 
other hardware (such as hard disk drives) in order to 
install the OverDrive Processor. Since Math Coproc- 
essor sockets are typically found near the CPU 
socket on the motherboard, similarly locating the 
OverDrive Processor Socket near the CPU further 
adds to the ease of installation. 



Component Orientation: The most common mis- 
take made by end-users and resellers when install- 
ing Math Coprocessor upgrades is incorrect orienta- 
tion of the chip. This can result in irreversible dam- 
age to the chip and/or the PC. To solve this prob- 
lem, Intel has designed the OverDrive Processor 
with a 169 pin Pin Grid Array (PGA) pinout, with the 
169th pin as a non-electrical "key pin" used to en- 
sure proper orientation of the OverDrive Processor 
by the PC user. The OverDrive Processor Socket 
should, therefore, be a 1 69 pin PGA socket compati- 
ble with the OverDrive Processor pinout.(i) In addi- 
tion, the location of the key pin should be clearly 
marked on the motherboard or CPU card, for exam- 
ple by silk screening. 

Insertion Force: The third major concern voiced by 
end-users refers to how much pressure should be 
exerted on the chip and PC board for proper installa- 
tion without damage. This becomes even more of a 
concern with the larger 1 69 pin components which 
require up to 150 pounds of pressure for insertion 
into a standard screw machine socket. This level of 
pressure can easily result in cracked traces and 
stress to solder joints. To minimize the risk of sys- 
tem damage, it is recommended that a Zero Inser- 
tion Force (ZIF) socket be used for the OverDrive 
Processor Socket. Designing with a ZIF socket elimi- 
nates the need to design in additional structural sup- 
port to prevent flexing of the PC board during instal- 
lation, and results in improved end-user and reseller 
product satisfaction due to easy "drop-in" installa- 
tion. 



1 2. 1 OverDrive Processor Overview 

The Intel OverDrive Processor is essentially an en- 
hanced Intel486 Microprocessor. There are three 
functional differences between the Intel OverDrive 
Processor and Intel486 Microprocessors. First, the 
Intel OverDrive Processor has an internal clock dou- 
bling circuit which decreases the time required to 
execute instructions. Second, the Intel OverDrive 
Processor does not support the JTAG boundary 
scan test feature (available with the PQFP version of 
the Intel486 DX Microprocessor). Third, the Intel 
OverDrive Processor has a different CPU revision 
identification than the Intel486 DX CPU. These three 
differences are described in the following sections 
according to how they effect the CPU functionality. 

12.1.1 HARDWARE INTERFACE 

The Intel OverDrive Processor bus has been de- 
signed to be identical with the Intel486 Microproces- 
sor bus. Although the external clock is internally 
doubled and data and instructions are manipulated 
in the CPU core at twice the external frequency, the 
external bus is functionally identical with the Intel486 
CPU. 
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The four boundary scan test signals (TCK, Test 
clock; TMS, Test Mode select; TDI, Test Data Input; 
TDO, Test Data Output), defined for the PQFP Intel 
486 SX CPU, are not specified for the Intel Over- 
Drive Processor. 

The UP# (Upgrade Present) signal, which is defined 
as an input for the PQFP Intel486 CPU, is an output 
signal on the Intel OverDrive Processor. The UP# 
pin on the Intel OverDrive Processor provides a logi- 
cal low output signal which can be used to enable 
logic to recognize and configure the system for the 
Intel OverDrive Processor. 

The DX register always contains the component 
identifier at the conclusion of RESET. The Intel 
OverDrive Processor has a different revision identifi- 
er in the DL register than the Intel486 DX Microproc- 
essor. When the OverDrive Processor is installed in 
a system the component identifier is supplied by the 
OverDrive Processor, rather than the original CPU. 
The stepping identification portion of the component 
identification will change with different revisions of 
the OverDrive Processor. The designer should only 
assume that the component identification for the 
OverDrive Processor will be 043xH, where 'x' is the 
stepping identifier. 

12.1.2 TESTABILITY 

As detailed in Section 13.1.1, the Intel OverDrive 
Processor does not support the JTAG boundary 
scan testability feature. 

12.1.3 INSTRUCTION SET SUMMARY 

The Intel OverDrive Processor supports all Intel486 
extensions to the 8086/80186/80286 instruction 
set. In general, instructions will execute faster on the 
Intel OverDrive Processor than the Intel486 Micro- 
processor. Specifically, an instruction that only uses 
memory from the on-chip cache executes at the full 
core clock rate while all bus accesses execute at the 
bus clock rate. To calculate the elapsed time of an 
instruction, the number of clock counts for that in- 
struction must be multiplied by the clock period for 
the system. The instruction set clock count summary 
tables from Section 1 0.0 can be used for the Over- 
Drive Processor witth the following modifications: 

— Clock counts for a cache hit: This value repre- 
sents the number of internal CPU core clocks for 
an instruction that requires no external bus ac- 
cesses or the base core clocks for an instruction 
requiring external bus accesses. 

— Penalty clock counts for a cache miss: This value 
represents the worst-case approximation of the 
additional number of external clock counts that 
are required for an instruction which must access 



the external bus for data (a cache miss). This num- 
ber must be multiplied by 2 to convert it to an equal 
number of internal CPU core clock counts and add- 
ed to the base core clocks to compute the total 
number of core clocks for this instruction. 

The actual number of core clocks for an instruction 
with a cache miss may be less than the base clock 
counts (from the cache hit column) plus the penalty 
clock counts (2 times the cache miss column num- 
ber). The clock counts in the cache miss penalty 
column can be a cumulative value of external bus 
clocks (for data reads) and internal clocks for manip- 
ulating the data which has been loaded from the ex- 
ternal bus. The number of clocks which are related 
to external bus accesses are correctly represented 
in terms of internal core clocks by multiplying by two. 
However, the clock counts related to internal data 
manipulation should not be multiplied by two. There- 
fore the total number of CPU core clock counts for 
an Instruction with a cache miss represents a worst- 
case approximation. 

To calculate the execution time for an OverDrive 
Processor instruction, multiply the total CPU core 
clock counts by the core clock period. For example, 
in a 25 MHz system the core clock period is 50 ns 
(1/50 MHz). 

Additionally, the assumptions specified below 
should be understood in order to estimate instruc- 
tion execution time. 

A cache miss will force the OverDrive Processor to 
run an external bus cycle. The Intel486 DX micro- 
processor 32-bit burst bus is defined as r-b-w. 

Where: 

r = The number of bus clocks in the first cycle of a 
burst read or the number of clocks per data 
cycle is a non-burst read. 

b = The number of bus clocks for the second and 
subsequent cycles in a burst read. 

w = The number of bus clocks for a write. 

The fastest bus the OverDrive Processor can sup- 
port is 2-1-2 assuming wait states. The clock 
counts in the cache miss penalty column assume a 
2-1-2 bus. For slower busses add r-2 clocks to 
the cache miss penalty for the first dword accessed. 
Other factors also affect instruction clock counts. 

Instruction Clock Count Assumptions 

1 . The external bus is available for reads or writes at 
all times. Else add bus clocks to reads until the 
bus is available 

2. Accesses are aligned. Add three core clocks to 
each misaligned access. 
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3. Cache fills complete before subsequent accesses 
to the same line. If a read misses the cache dur- 
ing a cache fill due to a previous read or prefetch, 
the read must wait for the cache fill to complete. If 
a read or write accesses a cache line still being 
filled, it must wait for the fill to complete. 

4. If an effective address is calculated, the base reg- 
ister is not the distination register of the preceding 
instruction. If the base register is the destination 
register of the preceding instruction add 1 to the 
core clock counts shown. Back-to-back PUSH 
and POP instructions are not affected by this rule. 

5. An effective address calculation uses one base 
register and does not use an index register. 
However, If the effective address calculation 
uses an index register. 1 core clock may be add- 
ed to the clock shown. 

6. The target of a jump is in the cache. If not, add r 
clocks for accessing the destination instruction 
of a jump. If the destination instruction is not 
completely contained in the first dword read, add 
a maximum of 3b bus clocks. If the destination 
instruction is not completely contained in the first 
16 byte burst, add a maximum of another r+3b 
bus clocks. 

7. If no write buffer delay, w bus clocks are added 
only in the case in which all write buffers are full. 



8. Displacement and immediate not used together. 
If displacement and immediate used together, 1 
core clock may be added to the core clock count 
shown. 

9. No invalidate cycles. Add a delay of 1 bus clock 
for each invalidate cycle if the invalidate cycle 
contends for the internal cache/external bus 
when the OverDrive Processor needs to use it. 

1 0. Page translation hits in TLB. A TLB miss will add 
13, 21 or 28 bus clocks + 1 possible core clock 
to the instruction depending on whether the Ac- 
cessed and/or Dirty bit in neither, one or both of 
the page entries needs to be set in memory. This 
assumes that neither page entry is in the data 
cache and a page fault does not occur on the 
address translation. 

1 1 . No exceptions are detected during instruction 
execution. Refer to interrupt core Clock Counts 
Table for extra clocks if an interrupt is detected. 

12. Instructions that read multiple consecutive data 
items (i.e., task switch, POPA, etc.) and miss the 
cache are assumed to start the first access on a 
16-byte boundary. If not, an extra cache line fill 
may be necessary which may add up to (r+3b) 
bus clocks to the cache miss penalty. 
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12.2 Intel OverDrive™ Processor 
Circuit Design 

Figure 12.1 shows the interface circuit for the 
Intel486 DX CPU and the OverDrive Processor sock- 
et. This circuit allows Intel486 DX CPU-based sys- 
tems to be upgraded with the OverDrive Processor. 

12.2.1 UPGRADE CIRCUIT FOR PGA INTEL486 
DX BASED SYSTEMS 

The Intel OverDrive Processor Socket Circuit for In- 
tel486 DX CPU based systems allows the Intel486 
DX CPU complete control of the system when the 
Intel OverDrive Processor Socket is unpopulated. 
The HLDA signal from the Intel OverDrive Processor 
Socket should be tied low through a resistor while 
the UP# and FERR# signals from the Intel Over- 
Drive Processor Socket should be tied high through 
a resistor to insure that the Intel486 DX CPU func- 
tions correctly when an Intel OverDrive Processor 
Socket component is not Installed. 

When the Intel OverDrive Processor is installed, the 
Upgrade Present output, UP# pin, causes the 
FLUSH # and BOFF# signals to be driven active to 
the Intel486 DX CPU. When the Intel486 DX CPU 



samples FLUSH # active during reset, the Intel486 
DX CPU enters tri-state output test mode after reset, 
which causes the Intel486 DX CPU to float all of its 
output signals. To float most of the Intel486 DX 
CPU's output pins before the end of reset, BOFF# 
is also driven active to the Intel486 DX CPU. BOFF# 
immediately causes all output signals to float except 
PCHK#, BREQ, HLDA and FERR#. 

In addition to floating the Intel486 DX CPU's outputs, 
the Intel486 DX CPU's HLDA and FERR# signals 
must be gated to prevent potential bus contention 
with the Intel OverDrive Processor's HLDA and 
FERR# signals during reset. During reset the In- 
tel486 DX CPU may not recognize HOLD active be- 
cause BOFF# is driven active to the Intel486 DX 
CPU by the Intel OverDrive Processor. If the Intel486 
DX CPU does not recognize HOLD active, it will not 
drive HLDA active. However, the Intel OverDrive 
Processor will recognize HOLD active and drive 
HLDA. By gating the HLDA signals from the Intel486 
DX CPU and Intel OverDrive Processor Socket, bus 
contention is avoided if HOLD is driven active during 
reset. Because the state of FERR# Is undefined 
during reset, bus contention is also avoided by gat- 
ing FERR#. 



DATA ADDR CTRL 
> CLK HLDA 



FLUSH# p- 

Intel 
OVERDRIVETM UP# |0- 
PROCESSOR 



BOFF# O- 
IGNNE# FERR# HOLD 

T 



T 






^— ^ HIDA 



DATA ADDR CTRL 
> CLK HLDA 

FLUSH# 

PGA 
I486TMDX 

BOFF# 

IGNNE# FERR# HOLD 



i 



p- 




Vcc BOFF# FLUSH# 



Figure 12.1. Intel OverDriveTM Socket Circuit Diagram for PGA lnte!486TM DX CPU Based Systems 



179 



intel^ 



lntel486TM dX MICROPROCESSOR 



IPI^ilLDlJflDKIAI^V 



12.3 Socket Layout 

This section discusses three aspects for the Over- 
Drive Processor Socket: size, upgradability, and ven- 
dors. 



12.3.1 PHYSICAL DIMENSIONS 

The OverDrive Processor Socket for Intel486 DX mi- 
croprocessor-based systems is equivalent to a stan- 
dard 1 69-lead PGA package. 

The OverDrive Processor will be provided with a 
heat sink attached (see Figure 12-2), to dissipate 
heat. 

The maximum and minimum dimensions of the 
OverDrive Processor package with the heat sink are 
shown in Table 1 2-1 . 



Table 12.1. OverDrive Processor, 169-Pin, PGA 
Package Dimensions with Heat Sink Attached 



Dimension (Inches) 


Minimum 


Maximum 


A. Heat Sink Width 


1.520 


1.550 


B. PGA Package 
Width 


1.735 


1.765 


C. Heat Sink Edge 
Gap 


0.065 


0.155 


D. Heat Sink Height 


0.212 


0.260 


E. Adhesive 
Thickness 


0.008 


0.012 


F. Package Height 
from Stand-Offs 


0.140 


0.180 


G. Total Height from 
Stand-Offs to Top 
of Heat Sink 


0.360 


0.452 



OVERDRIVE PROCESSOR 
OMNI-DIRECTIONAL HEAT SINK 



UPGRADE PROCESSOR. 169 PIN, PGA PACKAGE 



T 
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E 

■: L 



F 



Figure 12.2. Intel OverDriveTM Processor, 169-Pin, PGA Package with Heat Sink Attached 
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Family: Ceramic Pin Grid Array Package 


Symbol 


Millimeters 


Inches 


Min 


Max 


Notes 


Min 


Max 


Notes 


A 


3.56 


4.57 




0.140 


0.180 




Ai 


0.64 


1.14 


SOLID LID 


0.025 


0.045 


SOLID LID 


A2 


2.8 


3.5 


SOLID LID 


0.110 


0.140 


SOLID LID 


A3 


1.14 


1.40 




0.045 


0.055 




B 


0.43 


0.51 




0.017 


0.020 




D 


44.07 


44.83 




1.735 


1.765 




Di 


40.51 


40.77 




1.595 


1.605 




ei 


2.29 


2.79 




0.090 


0.110 




L 


2.54 


3.30 




0.100 


0.130 




N 


169 




169 




Si 


1.52 


2.54 




0.060 


0.100 




ISSUE 


IWS REVX 7/15/88 





Figure 12.3. Intel OverDriveTM Processor, 169-Lead Ceramic PGA Package Dimensions 
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Table 12.2. Intel OverDriveTM Processor Ceramic PGA Package Dimension Symbols 



Letter or 
Symbol 


Description of Dimensions 


A 


Distance from seating plane to highest point of body 


Ai 


Distance between seating plane and base plane (lid) 


A2 


Distance from base plane to highest point of body 


A3 


Distance from seating plane to bottom of body 


B 


Diameter of terminal lead pin 


D 


Largest overall package dimension of length 


Di 


A body length dimension, outer lead center to outer lead center 


ei 


Linear spacing between true lead position centerlines 


L 


Distance from seating plane to end of lead 


Si 


Other body dimension, outer lead center to edge of body 



NOTES: 

1. Controlling dimension: millimeter. 

2. Dimension "e-i" ("e") is non-cumulative. 

3. Seating plane (standoff) Is defined by P.C. board hole size: 0.0415-0.0430 inch. 

4. Dimensions "B", "B-i" and "C" are nominal. 

5. Details of Pin 1 identifier are optional. 
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Figure 12.4. Intel OverDriveTM Processor Heat Sink Dimensions 
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12.3.2 "END USER EASY" UPGRADABILITY 

PC buyers value easy and safe upgrade installation. PC manufacturers can make the Intel OverDrive Proces- 
sor installation in the Intel OverDrive Processor Socket simple and foolproof for the end user and reseller by 
implementing the suggestions listed in Table 12-3. 

Table 12.3. Socket and Layout Considerations 



"End User Easy" 
Feature 


Implementation 


Visible OverDrive Processor Socket 


The Intel OverDrive Processor Socket should be easily visible when 
the PC's cover Is removed. Label the Intel OverDrive Processor Socket 
and the location of pin 1 by silk screening this information on the PC 
board. 


Accessible Overdrive Processor 
Socket 


Make the Intel OverDrive Processor Socket easily accessible to the 
end user (i.e., do not place the Intel OverDrive Processor Socket under 
a disk drive). If a Low Insertion Force (LIF) or screw machine socket is 
used, position the Intel OverDrive Processor Socket on the PC board 
such that there is ample clearance around the socket. 


Foolproof Chip Orientation 


Intel packages all Intel OverDrive Processors in a 169-pln, PGA 
package. The 169th pin is called the "key" pin and insures that the 
Intel OverDrive Processor fits into a 169-pin socket in only the correct 
orientation. Supplying a 169-pln socket as the Intel OverDrive 
Processor Socket eliminates the possibility of end users or resellers 
damaging the PC board or Intel OverDrive Processor by powering up 
the system with the Intel OverDrive Processor incorrectly oriented. 


Zero Insertion Force 
Upgrade Socket 


The high pin count of the Intel OverDrive Processor makes the 
Insertion force required for installation In a screw machine PGA socket 
excessive for end users or resellers. Even most Low Insertion Force 
(LIF) sockets often require more than 60 lbs. of insertion force. A Zero 
Insertion Force (ZIF) socket insures that the chip insertion force does 
not damage the PC board. If the ZIF socket has a handle, be sure to 
allow enough clearance for the socket handle. If a LIF or screw 
machine socket is used, additional PC board support is recommended. 


"Plug and Play" 


Jumper or switch changes should not be needed to electrically 
configure the system for the Intel OverDrive Processor. 


Thorough Documentation 


Describe the Intel OverDrive Processor's installation procedure in the 
PC's User's Manual. 
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12.3.3 ZIF and LIF SOCKET VENDORS 

The following lists provide examples of sockets 
which can be used as the Intel OverDrive Socket for 
Intel486 DX CPU based systems. 

NOTE: 

This is not a comprehensive list. Intel has not test- 
ed the sockets listed below and cannot guarantee 
that these sockets will meet every PC manufactur- 
er's specific requirements. 



Zero Insertion Force Upgrade Sockets and 
Vendors: 

1. AMP Inc. 
P.O. Box 3608 
Harrisburg, PA 17105-3608 
Tel: (800) 522-6752 

Part Number: 55287-3 

Contact: Rick Simonic, New Product Manager 

(717)561-6143 

2. Aries Electronics 
P.O. Box 130 
Frenchtown, NJ 08825 
Tel: (908) 996-6841 

Part Number: 1 69-PRS1 701 2-1 

Contact: Frank Folmsbee, Marketing Manager 

(908) 996-6841 

3. JAE 

599 N. Mathilda Ave., Suite 8 

Sunnyvale, CA 94086 

Tel: (408) 733-0493 

Part Number: PCPS-1 69-002 

Contact: Bob Gerleman, Western Sales Manager 

(408) 733-0493 

4. Thomas and Betts 

200 Executive Center Drive 
P.O. Box 24901 
Greenville, SC 29616-2401 
Tel: (803) 676-2900 
Part Number: PGA169A17-S-1AC 
Contact: Scott Roland, 
Product Marketing Manager 
(803) 676-2910 

5. Yamaichi Electronics 
1420 Koll Circle, Suite B 
San Jose, CA 95112 
Tel: (408) 452-0797 

Part Number: NP11 1-1691 1-G4 
Contact: Jim Bennett, Sales Manager 
(408) 452-0797 



Low Insertion Force Sockets and Vendors: 

1. AMP Inc. 
P.O. Box 3608 
Harrisburg, PA 17105-3608 
Tel: (800) 522-6752 

Part Number: 
(Premium Base Material) 55589-5 
(Standard Base Material) 916227-3 

2. Thomas and Betts 

200 Executive Center Drive 

P.O. Box 24901 

Greenville, SC 29616-2401 

Tel: (803) 676-2900 

Part Number: LPG1 69A1 7-S-1 AC 



12.4 Thermal Management 

The OverDrive Processor Socket must be designed 
to dissipate the heat generated by the OverDrive 
Processor. In the following Sections the airflow re- 
quired over the OverDrive Processor Socket is cal- 
culated for a hypothetical system design. 



12.4.1 THERMAL CALCULATIONS FOR 
HYPOTHETICAL SYSTEM 

The maximum temperature specification for the 
OverDrive Processor is 85°C (with heat sink at- 
tached). Therefore, the temperature of the heat sink 
surface (Ts) cannot exceed 85°C under the worst 
case specified operating conditions for the system. 
The variables which affect the heat sink temperature 
include ambient temperature Inside the system box 
(Ta), Vcc. and Ice- An equation for the approximate 
OverDrive Processor temperature (Ts) is: 



Ts = Ta + Power * 0sA 



where Power = Vcc * Ice 



In the above equation, the variables under worst 
case conditions are specified as follows: 

Ts: Specified as 85°C for the OverDrive Processor 
(See Figure 12-5). 

Ta: Specified by the PC manufacturer for the 
worst case system operating conditions. 

Vcc: Specified for the OverDrive Processor as 5V. 

Ice'- Specified for the OverDrive Processor and re- 
lated to clock frequency. 

^Sa: ^SA = ^JA - ^JS- 

^jA and 0JS are specified in Table 1 3-4. 
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Figure 12.5. Heat Sink IVIeasurement (0.005" Dia. Thermocouple) on the Center of Heat Sink with a 90° 
Angle Adhesive Bond Through a Hole Drilled Through the Center of the Name Plate. 



The OverDrive Processor for Intel486 DX CPU- 
based systems will be provided with a heat sink. The 
^js and ^jA values for the OverDrive Processor with 
a heat sink are shown in Table 12-4. The maximum 
Ta values for the 25 MHz and 33 MHz OverDrive 
Processor are shown in Table 12-5. The maximum 
Ta values shown in Table 1 2-5 were calculated us- 
ing Ts = 85°C, Vcc = 5V, the maximum Ice values, 
and the ^ja and 6js values shown in Table 1 2-4. 



Table 


12.4. Thermal Resistance 
rC/W) Ojs and 0ja 


i 




OverDrive 
with Heat Sink 


^JS 


Airflow { 


ft/min, LFM) 


2.5°C/W 


0* 


200 


400 


600 


800 


^jaTC/W) 


14.0 


10.0 


7.5 


6.2 


5.7 



NOTE: 

*The thermal resistance from the junction to ambient (0ja) 
in static air is actually a linear function of power dissipation. 
The value shown in the table (14.0 °C/W) represents the 
worst case expected value. 

Table 12.5. Maximum Ta for 25 MHz and 
33 MHz OverDrive Processor 



OverDrive 

Processor 

with Heat 

Sink 




Linear Airflow (ft/min) 


fCLK 
(MHz) 





200 


400 


600 


800 


Ta 
(°C) 


25 
33 


30 
16 


49 
40 


61 
55 


67 
63 


70 
66 



12.4.2 HEAT SINKS 

The OverDrive Processor is shipped with a heat sink 
attached. Because of the heat sink, it is vital that 
vertical clearance is provided for the OverDrive 
Processor Socket. The height of the package and 
the heat sink is shown in Table 12-1 in Section 
12.2.1. 



1 2.5 BIOS and Software 

The following should be considered when designing 
the Upgrade Socket for a Intel486 DX2 microproces- 
sor-based system. 



12.5.1 INTEL OVERDRIVE PROCESSOR 
DETECTION 

The component identifier and stepping/revision 
identifier for the Intel OverDrive Processor is read- 
able in the DM and DL registers respectively, imme- 
diately after RESET, where 

DH = I5h 
DL = 30h-3Fh 
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As it is difficult to differentiate betwee the Intel486 
DX CPU and the Intel OverDrive Processor in soft- 
ware, it is recommended that the BIOS save the 
contents of the DX register, immediately after RE- 
SET, so that this information can be used later, if 
required, to identify an Intel OverDrive Processor in 
the system. 

12.5.2 TIMING DEPENDENT LOOPS 

The Intel OverDrive Processor executes instructions 
at twice the frequency of the input clock. Thus soft- 
ware (or instuction based) timing loops will execute 
faster on the Intel OverDrive Processor than on the 
Intel486 DX or Intel486 SX CPU (at the same input 
clock frequency). Instructions such as NOP, LOOP, 
and jMP $ + 2, have been used by BIOS to imple- 
ment timing loops that are required, for example, to 
enforce recovery time between consecutive access- 



es for I/O devices. These Instruction based, timing 
loop implementations may require modification for 
systems intended to be upgradable with the Intel 
OverDrive Processor. 

In order to avoid any incompatibilities. It is recom- 
mended that timing requirements be iimplemented in 
hardware rather than in software. This provides 
transparency and also does not require any change 
in BIOS or I/O device drivers in the future when 
moving to higher processor clock speeds. As an ex- 
ample, a timing routine may be Implemented as fol- 
lows: The software performs a dummy I/O instruc- 
tion to an unused I/O port. The hardware for the bus 
controller logic recognizes this I/O instruction and 
delays the termination of the I/O cycle to the CPU 
by keeping RDY# or BRDY# deasserted for the ap- 
propriate amount of time. 
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1 2.6 OverDrive Processor Socket Pinout 
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Figure 12.6 Intel OverDrlveTM Processor Socket Pinout for InteUSBTM DX CPU System (Pin Side View) 
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Figure 12.7. Intel OverDrive™ Processor Socket PInout for JnteWSe™ DX CPU System (Top Side View) 
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Table 12.6. Pin Cross Reference by Pin Name 



Address 


Data 


Control 


N/C 


Vcc 


Vss 


A2 Q14 


Do 


P1 


A20M# 


D15 


A10 


B7 


A7 


A3 R15 


Di 


N2 


ADS# 


S17 


A12 


B9 


A9 


A4 S16 


D2 


N1 


AHOLD 


A17 


A14 


B11 


All 


A5 Q12 


D3 


H2 


BEO# 


K15 


B12 


C4 


B3 


As S15 


D4 


M3 


BE1# 


J16 


B13 


C5 


B4 


A7 Q13 


D5 


J2 


BE2# 


J15 


CIO 


E2 


B5 


As R13 


De 


L2 


BE3# 


F17 


C13 


El 6 


El 


Ag Q11 


D7 


L3 


BLAST # 


R16 


G15 


G2 


E17 


A10 S13 


Ds 


F2 


BOFF# 


D17 


R17 


G16 


G1 


A11 R12 


Dg 


D1 


BRDY# 


H15 


S4 


H16 


G17 


A12 S7 


D10 


E3 


BREQ# 


015 


A3 


J1 


HI 


Ai3 Q10 


D11 


C1 


BS8# 


D16 
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K2 


H17 


Ai4 S5 


D12 


G3 


BS16# 


C17 


B16 


K16 


K1 


Ai5 R7 


Di3 


D2 


CLK 


C3 


C11 


L16 


K17 


A16 Q9 


D14 


K3 


D/C# 


M15 


CI 2 


M2 


LI 


Ai7 Q3 


Di5 


F3 


DPO 


N3 


CI 4 


M16 


LI 7 


A18 R5 


D16 


J3 


DP1 


F1 




P16 


Ml 


Ai9 Q4 
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D3 


DP2 


H3 




R3 


M17 


A20 Q8 


D18 


C2 
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A5 




R6 


P17 


A21 Q5 
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B1 


EADS# 


B17 




R8 


02 


A22 Q7 
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A1 
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R9 


R4 


A23 S3 
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B2 
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S6 


A24 Q6 
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A2 
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S8 
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E15 
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S9 
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A6 
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S11 
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C7 
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S14 


A30 P3 
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C8 
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A31 Q1 


D29 


A8 
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D30 


C9 


PCD 
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D31 


88 


PCHK# 

PWT 

PLOCK# 

RDY# 

RESET 

UP# 

W/R# 
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017 
LI 5 
016 
F16 
CI 6 
B14 
N17 
D4 
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Table 12-7. Intel OverDriveTM Processor Socket Pin Description 



Symbol 


Type 


Name and Function 


Intel486 DX2 CPU INTERFACE 


UP# 





The Upgrade Present p\n is used to signal tlie Intel486 DX microprocessor to float its 
outputs and get-off the bus. It is active low and is never floated. UP# is driven low at 
power-up and remains active for the entire duration of the Upgrade Processor 
operation. 


KEY PIN 


KEY 




The Key pin is an electrically non-functional pin which is used to ensure correct 
orientation for 1 69-pin upgrade products. 



1 2.7 D.C./ A.C. Specifications 

The electrical specifications in this section represent 
the electrical interface of the Upgrade Processor for 
a Intel486 DX microprocessor-based system. The 



OverDrive Processor is compatible to the maximum 
ratings and A.C. Specifications of the Intel486 DX 
Microprocessor. Table 1 2-8 provides the D.C. Oper- 
ating Conditions for the OverDrive Processor. 



Table 12-8. Intel OverDriveTM Processor Socket D.C. Parametric Values(i) 



Symbol 


Parameter 


Min 


Max 


Unit 


Notes 


V|L 


Input Low Voltage 


-0.3 


+ 0.8 


V 




V|H 


Input High Voltage 


2.0 


Vcc + 0.3 


V 




Vol 


Output Low Voltage 




0.45 


V 


(Note 2) 


VOH 


Output High Voltage 


2.4 




V 


(Note 3) 


'cc 


Power Supply Current 
CLK = 25 MHz 
CLK = 33 MHz 




950 
1200 


mA 


(Note 4) 


III 


Input Leakage Current 




±15 


,xA 


(Note 5) 


l|H 


Input Leakage Current 




200 


;xA 


(Note 6) 


l|L 


Input Leakage Current 




-400 


iuiA 


(Note 7) 


Ilo 


Output Leakage Current 




±15 


fxA 




C|N 


Input Capacitance 




13 


PF 


Fc = 1 MHz(8) 


Co 


I/O or Output Capacitance 




17 


PF 


Fc = 1 MHz(8) 


CcLK 


CLK Capacitance 




15 


pF 


Fc = 1 MHz(8) 



NOTES: 

1. Functional operating range: Vcc = 5V; Ts = 0°C to +85'C. 

2. This parameter is measured at: 

— Address, Data, BEn 4.0 mA 

— Definition, Control 5.0 mA 

3. This parameter is measured at: 

— Address, Data, BEn - 1 .0 mA 

— Definition, Control -0.9 mA 

4. Typical supply current: 
775 mA @ CLK = 25 MHz 
975 mA @ CLK = 33 MHz 

5. This parameter is for inputs without pullups or pulldowns and ^ V|n ^ Vcc- 

6. This parameter is for inputs with pulldowns and V|h = 2.4V. 

7. This parameter is for inputs with pullups and V|l = 0.45V. 

8. Not 100% tested. 
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13.0 ELECTRICAL DATA 

The following sections describe recommended elec- 
trical connections for the Intel486 Microprocessor, 
and its electrical specifications. 



13.1 Power and Grounding 

13.1.1 POWER CONNECTIONS 

The Intel486 Microprocessor is implemented in 
CHMOS IV technology and has modest power re- 
quirements. However, its high clock frequency out- 
put buffers can cause power surges as multiple out- 
put buffers drive new signal levels simultaneously. 
For clean on-chip power distribution at high frequen- 
cy, 24 Vcc and 28 Vss pins feed the Intel486 Micro- 
processor. 

Power and ground connections must be made to all 
external Vcc and GND pins of the Intel486 Micro- 
processor. On the circuit board, all Vcc P'ns must be 
connected on a Vcc plane. All Vss P'ns must be 
likewise connected on a GND plane. 

13.1.2 POWER DECOUPLING 
RECOMMENDATIONS 

Liberal decoupling capacitance should be placed 
near the Intel486 Microprocessor. The Intel486 Mi- 
croprocessor driving its 32-bit parallel address and 
data busses at high frequencies can cause transient 
power surges, particularly when driving large capacl- 
tive loads. 



Low Inductance capacitors and interconnects are 
recommended for best high frequency electrical per- 
formance. Inductance can be reduced by shortening 
circuit board traces between the Intel486 Microproc- 
essor and decoupling capacitors as much as possi- 
ble. Capacitors specifically for PGA packages are 
also commercially available. 

13.1.3 OTHER CONNECTION 
RECOMMENDATIONS 

N.C. pins should always remain unconnected. 

For reliable operation, always connect unused in- 
puts to an appropriate signal level. Active LOW in- 
puts should be connected to Vcc through a pullup 
resistor. Pullups in the range of 20 KH are recom- 
mended. Active HIGH inputs should be connected to 
GND. 



13.2 Maximum Ratings 

Table 13.1 is a stress rating only, and functional op- 
eration at the maximums is not guaranteed. Function 
operating conditions are given in 13.3 D.C. Specifi- 
cations and 1 3.4 A.C. Specifications. 

Extended exposure to the Maximum Ratings may af- 
fect device reliability. Furthermore, although the 
Intel486 Microprocessor contains protective circuitry 
to resist damage from static electric discharge, al- 
ways take precautions to avoid high static voltages 
or electric fields. 



191 



Intel < 



lntel486TM DX MICROPROCESSOR 



IPI^iHOIiiiilDIMAI^Y 



Table 13.1. Absolute Maximum Ratings 

Case Temperature under Bias . . . -65°C to + 11 0°C 
Storage Temperature -65°C to + 150°C 



Voltage on Any Pin with 

Respect to Ground -0.5 to Vcc + 0.5V 

Supply Voltage with 

Respectto Vss -0.5V to +6.5V 



1 3.3 D.C. Specifications 

Functional Operating Range: Vcc = 5V ±5%; Tcase = 0°C to +85°C 



Table 13.2. lntel486TM DX Microprocessor DC Parametric Values (for PGA Package) 


Symbol 


Parameter 


Min 


Max 


Unit 


Notes 


V|L 


Input Low Voltage 


-0.3 


+ 0.8 


V 




V|H 


Input High Voltage 


2.0 


Vcc +0.3 


V 




Vol 


Output Low Voltage 




0.45 


V 


(Notel) 


VOH 


Output High Voltage 


2.4 




V 


(Note 2) 


Ice 


Power Supply Current (50 MHz) 
Power Supply Current (33 MHz) 
Power Supply Current (25 MHz) 




1000 
900 
766 


mA 


(Note 3) 


Ili 


Input Leakage Current 


\ - ' 


^^^; ±15 


liA 


(Note 4) 


l|H 


Input Leakage Current 




;:200 


jaA 


(Note 5) 


l|L 


Input Leakage Current 


^ r~^^\ 


-400 


^A 


(Note 6) 


Ilo 


Output Leakage Current 


\ , X ^ 


±15 


JLlA 




C|N 


Input Capacitance 
(25 MHz and 33 MHz) 
(50 MHz) 




20 
13 


PF 
PF 


Fc = 1 MHz (Note 7) 
Fc = 1 MHz (Note 7) 


Co 


I/O or Output Capacitance 
(25 MHz and 33 MHz) 
(50 MHz) 




20 
17 


pF 
pF 


Fc = 1 MHz (Note 7) 
Fc = 1 MHz (Note 7) 


CcLK 


CLK Capacitance 
(25 MHz and 33 MHz 
(50 MHz) 




20 
15 


pF 
pF 


Fc = 1 MHz (Note 7) 
Fc = 1 MHz (Note 7) 



NOTES: 

1. This parameter is measured at: 
Address, Data, BEn 4.0 mA 
Definition, Control 5.0 mA 

2. This parameter is measured at: 
Address, Data, BEn - 1 .0 mA 
Definition, Control -0.9 mA 

3. Typical supply current: 
550 mA @ 25 MHz 
700 mA @ 33 MHz 
800 mA @ 50 MHz 

4. This parameter is for inputs without internal pullups or pulldowns and ^ V|n ^ Vcc- 

5. This parameter is for inputs with internal pulldowns and V|h = 2.4V. 

6. This parameter is for inputs with internal pullups and V|l = 0.45V. 

7. Not 100% tested. 
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1 3.4 A.C. Specifications 

The A.C. specifications, given in Table 13.3, consist 
of output delays, input setup requirements and input 
hold requirements. All A.C. specifications are rela- 
tive to the rising edge of the CLK signal. 

A.C. specifications measurement is defined by Fig- 
ures 13.1-13.7. All timings are referenced to 1.5V 
unless otherwise specified. Inputs must be driven to 
the voltage levels indicated by Figure 13.3 when 



A.C. specifications are measured. Intel486 Micro- 
processor output delays are specified with minimum 
and maximum limits, measured as shown. The mini- 
mum Intel486 Microprocessor delay times are hold 
times provided to external circuitry. Intel486 Micro- 
processor input setup and hold times are specified 
as minlmums, defining the smallest acceptable sam- 
pling window. Within the sampling window, a syn- 
chronous input signal must be stable for correct 
Intel486 Microprocessor operation. 
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Table 13.3. 25 MHz lntel486TM Microprocessor A.C. Characteristics (PGA) 

Vcc = 5V ±5%; TcASE = 0°C to +85°C; Cl = 50 pF unless otherwise specified 


Symbol 


Parameter 


MIn 


Max 


Unit 


Figure 


Notes 




Frequency 


8 


25 


MHz 




IX CLK to Intel486 


ti 


CLK Period 


40 


125 


ns 


13.1 




tla 


CLK Period Stability 




0.1% 


A 




Adjacent Clocks 


t2 


CLK High Time 


14 




ns 


13.1 


at2V(i) 


t3 


CLK Low Time 


14 




ns 


13.1 


at0.8V(i) 


t4 


CLK Fall Time 




4 


ns 


13.1 # 


J2V-0.8V)(1) 


t5 


CLK Rise Time 




4 


ns 


i3.r^ 1 


•|0.8V - 2V)(1) 


t6 


A2-A31, PWT, PCD, BE0-3#, 
M/IO#,D/C#,W/R#,ADS#, 
LOCK#, FERR#, BREQ, HLDA 
Valid Delay 


3 


22 n 


* ns 


13.6 




t7 


A2-A31, PWT, PCD, BE0-3#, 
M/IO#,D/C#,W/R#,ADS#, 
LOCK# Float Delay 


# 


;r 30 ^^ 


^^ 


13.6 


(Notel) 


t8 


PCHK# Valid Delay 


''' 3 ^, 


ill ^^. 


iiAJ 


13.4 




tea 


BLAST#, PLOCK# Valid Delay 


JiiS 


C^lyJII 


i,% 


13.5 




t9 


BLAST#, PLOCK# Float Delay 


>;^# 


..k^»^ 


ns 


13.6 


(Notel) 


tio 


D0-D31 , DPO-3 Write Data Valid 
Delay 


■*|| 


|P 


ns 


13.5 




tl1 


D0-D31 , DPO-3 Write Data Float 
Delay 


y 


30 


ns 


13.6 


(Notel) 


tl2 


EADS# Setup Time ^ 


8 




ns 


13.2 




ti3 


EADS# Hold Time 


3 




ns 


13.2 




tl4 


KEN#, BS16#, BS8# Setup Time 


8 




ns 


13.2 




tl5 


KEN#, BS16#, BS8# Hold Time 


3 




ns 


13.2 




tl6 


RDY#, BRDY# Setup Time 


8 




ns 


13.3 




tl7 


RDY#,BRDY# Hold Time 


3 




ns 


13.3 




tl8 


HOLD. AHOLD, BOFF# Setup Time 


10 




ns 


13.2 




tl9 


HOLD, AHOLD, BOFF# Hold Time 


3 




ns 


13.2 




t20 


RESET, FLUSH #, A20M#. NMI, 
INTR,IGNNE# Setup Time 


10 




ns 


13.2 




t21 


RESET, FLUSH #, A20M#, NMI, 
INTR,IGNNE# Hold Time 


3 




ns 


13.2 




t22 


D0-D31, DPO-3, A4-A31 Read 
Setup Time 


5 




ns 


13.2,13.3 




t23 


D0-D31, DPO-3, A4-A31 Read 
Hold Time 


3 




ns 


13.2,13.3 





NOTE: 

1. Not 100% tested. Guaranteed by design characterization. 
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Table 13.4. 33 MHz lntel486TM Microprocessor A.C. Characteristics (PGA) 

Vcc = 5V ±5%; TcASE = 0°C to +85°C; Cl = 50 pF unless otherwise specified 


Symbol 


Parameter 


Min 


Max 


Unit 


Figure 


Notes 




Frequency 


8 


33 


MHz 




IX CLK to Intel486 


ti 


CLK Period 


30 


125 


ns 


13.1 




tla 


CLK Period Stability 




0.1% 


A 




Adjacent Clocks 


t2 


CLK High Time 


11 




ns 


13.1 


at2V(i) 


t3 


CLK Low Time 


11 




ns 


13.1 


at0.8V(i) 


t4 


CLK Fall Time 




3 


ns 


13.1 .| 


^(2V-0.8V)(1) 


t5 


CLK Rise Time 




3 


ns 


i3-%ii 


*f0.8V - 2V)(1) 


t6 


A2-A31, PWT, PCD, BE0-3#, 
M/IO#,D/C#,W/R#,ADS#, 
LOCK#, FERR#, BREQ, HLDA 
Valid Delay 


3 


16 


^ ns 


#' 




ty 


A2-A31, PWT, PCD, BE0-3#, 
M/IO#,D/C#.W/R#,ADS#, 
LOCK# Float Delay 


^ ' : :> " 


^^'"' ,| 


ns . 


" 13.6 


(Notel) 


t8 


PCHK# Valid Delay 


3 


ill ^^ 


. ns 


13.4 




t8a 


BLAST#, PLOCK# Valid Delay: ^ 


^/ 


if to J 


ns 


13.5 




tg 


BLAST#, PLOCK# FloatOelay 


^ \ \ j^ 


ji^©^' 


ns 


13.6 


(Notel) 


tio 


D0-D31 , DPO-3 Write Data Valid 
Delay 


^^3..^ 


P' 


ns 


13.5 




tl1 


D0-D31. DPO-3 Write Data Float 
Delay . > > ' 




20 


ns 


13.6 


(Notel) 


tl2 


EADS# Setup Time ^ ' ^; >- 


5 




ns 


13.2 




tl3 


EADS# Hold Time > 


3 




ns 


13.2 




tl4 


KEN#, BS16#,BS8# Setup Time 


5 




ns 


13.2 




tl5 


KEN#, BSier. BS8# Hold Time 


3 




ns 


13.2 




tl6 


RDY#,BRDY# Setup Time 


5 




ns 


13.3 




tl7 


RDY#,BRDY# Hold Time 


3 




ns 


13.3 




tl8 


HOLD, AHOLD, Setup Time 


6 




ns 


13.2 




tl8a 


BOFF# Setup Time 


8 




ns 


13.2 




tl9 


HOLD, AHOLD, BOFF# Hold Time 


3 




ns 


13.2 




t20 


RESET, FLUSH #, A20M#, NMI, 
INTR,IGNNE# Setup Time 


5 




ns 


13.2 




t21 


RESET, FLUSH #, A20M#, NMI, 
INTR,IGNNE# Hold Time 


3 




ns 


13.2' 




^22 


D0-D31, DPO-3, A4-A31 Read 
Setup Time 


5 




ns 


13.2,13.3 




t23 


D0-D31, DPO-3, A4-A31 Read 
Hold Time 


3 




ns 


13.2,13.3 





NOTE: 

1. Not 100% tested. Guaranteed by design characterization. 
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Table 13.5. 50 MHz lntel486TM Microprocessor A.C. Specifications 

Vcc = 5V ±5%; TcASE = 0°C to +85*'C; Cl = See Note 2 


Symbol 


Parameter 


Min 


Max 


Unit 


Figure 


Notes 




Frequency 


16 


50 


MHz 




IX CLK to Intel486 


ti 


CLK Period 


20 


62.5 


ns 


13.1 




tla 


CLK Period Stability 




0.1% 






Adjacent Clocks 


t2 


CLK High Time 


7 




ns 


13.1 


at2V{i) 


t3 


CLK Low Time 


7 




ns 


13.1 


at0.8V(i) 


t4 


CLK Fall Time 




2 


ns 


13.1 


(2.0V-0.8V)(1) 


t5 


CLK Rise Time 




2 


ns 


13.1/^^ 


(0.8V-2.0V)(1) 


t6 


A2-A31. PWT, PCD, BE0-3#, M/IO#, 
D/C#, W/R#, ADS#, LOCK#, 
FERR#, BREQ, HLDA Valid Delay 


3 


12 ; 


ns 


13,6 




t7 


A2-A31, PWT, PCD, BE0-3#, M/IO#, 
D/C#, W/R#, ADS#, LOCK#, 
FERR#, BREQ Float Delay 




18 


ns 


13.6 


(Notel) 


t8 


PCHK# Valid Delay 


3 


14 


RS 


13.4 




tea 


BLAST#, PLOCK# Valid Delay ; 


.3 


12 . 


^^flS^ 


13.5 




t9 


BLAST#. PLOCK# Float Daiay ; ' 




18 


ns 


13.6 


(Notel) 


tio 


D0-D31, DPO-3 Write Data Valid Delay ^ 


3 


12 


ns 


13.5 




tl1 


D0-D31 , DPO-3 Write Data Float Delay 




> 18 


ns 


13.6 


(Notel) 


tl2 


EADS # Setup Tinfie / 


:::5 




ns 


13.2 




tl3 


EADS# Hold Time 


2 




ns 


13.2 




tl4 


KEN#,BS16#,BS8# Setup Tim^ ; 


5 




ns 


13.2 




tl5 


KEN#, BS16#, BS8# Hold time ^ 


2 




ns 


13.2 




tl6 


RDY#,BRDY# Setup Time 


5 




ns 


13.3 




tl7 


RDY#.BRby# Hold Time 


2 




ns 


13.3 




tl8 


HOLD, AHOLD Setup Time 


5 




ns 


13.2 




tl8a 


BOFF# Setup Time 


5 




ns 


13.2 




tl9 


HOLD, AHOLD, BOFF# Hold Time 


2 




ns 


13.2 




t20 


RESET, FLUSH#, A20M#, NMI, INTR, 
IGNNE# Setup Time 


5 




ns 


13.2 




t21 


RESET, FLUSH #. A20M#, NMI, INTR, 
IGNNE# Hold Time 


2 




ns 


13.2 




t22 


D0-D31, DP0--3, A4-A31 Read Data 
Setup Time 


4 




ns 


13.2,13.3 




t23 


D0-D31, DPO-3. A4-A31 Read Data 
Hold Time 


2 




ns 


13.2.13.3 





NOTES: 

1. Not 100% tested. Guaranteed by design characterization. 

2. Specifications assume Cl = pF. I/O Buffer model must be used to determine delays due to loading (trace and compo- 
nent). First Order I/O buffer models for the Intel486 CPU are available. Contact Intel for the latest release. 

3. All timings are referenced at 1 .5V (as illustrated in the listed figures) unless othen/vise noted. 
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Table 13.6. 50 MHz lntel486TM Microprocessor A.C. Characteristics for Boundary Scan Test Signals 

Vcc = 5V ±5%; TcASE = 0°C to +85°C; Cl = 50 pF. All Inputs and Outputs are TIL Level 


Symbol 


Parameter 


Min 


Max 


Unit 


Figure 


Notes 


t24 


TCK Frequency 




25 


MHz 




1x Clock 


t25 


TCK Period 


40 




ns 




(Note 2) 


t26 


TCK High Time 


10 




ns 




@2.0V 


t27 


TCK Low Time 


10 




ns 




@0.8V 


^28 


TCK Rise Time 




4 


ns 




(Notel) 


^29 


TCK Fall Time 




4 


ns 




(Notel) 


tso 


TDI,TMS Setup Time 


8 




ns 


13.7 


(Note 3) 


t31 


TDI. TMS Hold Time 


7 




ns 


13.7 


(Note 3) 


t32 


TDO Valid Delay 


3 


25 


ns 


13.7 


(Note 3) 


t33 


TDO Float Delay 




TBD 


ns 






t34 


All Outputs (Non-Test) Valid Delay 


3 


25 


ns 


13.7 


(Note 3) 


t35 


All Outputs (Non-Test) Float Delay 




36 


ns 


13.7 


(Notes 3, 5) 


t36 


All Inputs (Non-Test) Setup Time 


8 




ns 


13.7 


(Note 3) 


t37 


All Inputs (Non-Test) Hold Time 


7 




ns 


13.7 


(Note 3) 



NOTES: 

1. Rise/Fall times are measured between 0.8V and 2.0V. Rise/Fall times can be relaxed by 1 ns per 10 ns increase in TCK 
period. 

2. TCK period ^ CLK period. 

3. Parameter measured from TCK. 

4. Boundary Scan A.C. Specifications in the above table are target values. They have not been characterized. Therefore 
they are subject to change. 

5. Not 100% tested. Guaranteed by design characterization. 
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Figure 13.1. CLK Waveforms 
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Figure 13.2. Input Setup and Hold Timing 
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Figure 13.3. Input Setup and Hold Timing 
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Figure 13.5. Output Valid Delay Timing 



Figure 13.4. PCHK# Valid Delay Timing 
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Figure 13.6. Maximum Float Delay Timing 
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Figure 13.7. Test Signal Timing Diagram 



13.4.1 TYPICAL OUTPUT VALID DELAY VERSUS LOAD CAPACITANCE UNDER WORST CASE 
CONDITIONS FOR THE 25 MHz AND 33 MHz MHz Intel486 CPU 
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NOTE: 

This graph will not be linear outside of the Cl range shown. 
nom= nominal value given in A.C. Characteristics table. 
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13.4.2 TYPICAL OUTPUT VALID DELAY VERSUS LOAD CAPACITANCE UNDER WORST CASE 
CONDITIONS FOR THE 25 MHz and 33 MHz Intel486 CPU 
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This graph will not be linear outside of the Cl range shown. 
















nom = nominal value given In A.C. Characteristics table. 
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13.4.3.a TYPICAL LOADING DELAY VERSUS CAPACITIVE LOADING UNDER WORST-CASE 
CONDITIONS FOR A HIGH TO LOW TRANSITION ON THE 50 MHz Intel486 CPU 
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13.4.3.b TYPICAL LOADING DELAY VERSUS CAPACITIVE LOADING UNDER WORST-CASE 
CONDITIONS FOR A LOW TO HIGH TRANSITION ON THE 50 MHz Intel486 CPU 
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13.4.4 TYPICAL OUTPUT RISE TIME VERSUS 
LOAD CAPACITANCE UNDER WORST- 
CASE CONDITIONS 
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Designing for ICD-486 
(Advance Information) 



The ICD-486 (In-Circuit Debugger) is a hardware as- 
sisted debugger for the Intel486 CPU. To use the 
ICD-486, the Intel486 CPU component must be re- 
moved from Its socket replaced with the ICD-486 
module. Because of the high operating frequency of 
Intel486 CPU systems, there is no buffering of sig- 
nals between the Intel486 CPU in the ICD-486 and 
the target system. A direct result of the non-buffered 
interconnect is that the ICD-486 shares the address 
and data bus of the target system. In order for the 
ICD-486 to function properly (without the Optional 
Isolation Board Installed), the design of the target 
system must meet the following restrictions: 

1 . The bus controller must only enable data trans- 
ceivers onto the data bus during valid read cycles 
of the Intel486 CPU, other local devices, or other 
bus masters. 

2. Before another bus master drives the local proc- 
essor address bus, the other bus master must 
gain access to the address bus through the use 
of HOLD-HLDA, AHOLD, or BOFF#. 

In addition to the above restrictions, the ICD-486 has 
several electrical and mechanical characteristics 
that should be taken into consideration when de- 
signing the Intel486 CPU system. 

Capacitive Loading: ICD-486 adds up to 30 pF to the 
CLK signal, and up to 20 pF to each of the other 
Intel486 CPU signals. 



DC Loading: ICD-486 adds ±15 /xA loading to the 
CLK and data bus signals and ± 5 jliA loading to the 
address and control signals. 

Power Requirements: For noise immunity and 
CMOS latch-up protection the ICD-486 is powered 
by the target system through the power and ground 
pins of the Intel486 CPU socket. The circuitry on the 
ICD-486 draws up to 1.3A excluding the Intel486 
CPU Ice. 

No Connects: Pins specified as N.C. in the Intel486 
CPU pin description must be left unconnected. Con- 
nection of any of these pins to power, ground, or any 
other signal may cause the processor or the ICD- 
486 to malfunction. 

Intel486 CPU Location and Orientation: The ICD-486 
may require lateral clearance. Figure 1 3.4 shows the 
clearance requirements of the ICD-486. 

Optional Isolation Board (OIB) 

Due to its unbuffered design, the ICD-486 is suscep- 
tible to errors on the target system's bus. The OIB 
installs between the ICD-486 and Intel486 CPU 
socket in the target system and allows the ICD-486 
to function in systems with faults (i.e., shorted sig- 
nals). After electrical verification the OIB may be re- 
moved. The OIB has the following electrical and me- 
chanical characteristics: 

Buffer Characteristics: The OIB buffers the address 
and data busses as well as the byte enables, ADS#, 
W/R#. M/IO#, BLAST#, and HLDA. The buffers 
are advanced CMOS devices and have the following 
DC drive specifications: Iqh = ""15 mA, Iql = 
64 mA. The propagation delay of each buffer is 5 ns 
max driving a 50 pF load. To guarantee proper oper- 
ation with the OIB, the clock period should be in- 
creased by the round trip buffer delay (10 ns) unless 
the target system design already has enough timing 
margin. 

Unbuffered Signals: Signals not listed above as buff- 
ered are passed through the OIB and will have addi- 
tional capacitive loading due to the connectors and 
circuit board of up to 1 pF. 

Power Requirements: The OIB is also powered by 
the target system through the Intel486 CPU socket 
and requires 0.5A in addition to the ICD-486 and In- 
tel486 CPU requirements. 

OIB Clearance Requirements: The OIB requires an 
extra 0.55" of vertical clearance in the target system 
above the Intel486 CPU socket 
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Processor Module Board Dimensions 
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Processor l\/lodule Assembly Dimensions 
Top View 
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Processor Module Assembly Dimensions 
Side View 
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Processor Module Assembly Dimensions 
Side View, OIB Installed 
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Family: Ceramic Pin Grid Array Package 


Symbol 


Millimeters 


Inches 


Min 


Max 


Notes 


Min 


Max 


Notes 


A 


3.56 


4.57 




0.140 


0.180 




Ai 


0.64 


1.14 


SOLID LID 


0.025 


0.045 


SOLID LID 


A2 


2.8 


3.5 


SOLID LID 


0.110 


0.140 


SOLID LID 


A3 


1.14 


1.40 




0.045 


0.055 




B 


0.43 


0.51 




0.017 


0.020 




D 


44.07 


44.83 




1.735 


1.765 




Di 


40.51 


40.77 




1.595 


1.605 




ei 


2.29 


2.79 




0.090 


0.110 




L 


2.54 


3.30 




0.100 


0.130 




N 


168 




168 




Si 


1.52 


2.54 




0.060 


0.100 




ISSUE 


IWS REVX 7/15/88 





Figure 14.1. 168 Lead Ceramic PGA Package Dimensions 
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Table 14.1 Ceramic PGA Package Dimension Symbols 



Letter or 
Symbol 


Description of Dimensions 


A 


Distance from seating plane to highest point of body 


Ai 


Distance between seating plane and base plane (lid) 


A2 


Distance from base plane to highest point of body 


A3 


Distance from seating plane to bottom of body 


B 


Diameter of terminal lead pin 


D 


Largest overall package dimension of length 


Di 


A body length dimension, outer lead center to outer lead center 


ei 


Linear spacing between true lead position centerlines 


L 


Distance from seating plane to end of lead 


Si 


Other body dimension, outer lead center to edge of body 



NOTES: 

1 . Controlling dimension: millimeter. 

2. Dimension "ei" ("e") is non-cumulative. 

3. Seating plane (standoff) is defined by P.C. board hole size: 0.0415-0.0430 inch. 

4. Dimensions "B", "Bi" and "C" are nominal. 

5. Details of Pin 1 Identifier are optional. 



1 4. 1 Package Thermal Specifications 

The Intel486 Microprocessor is specified for opera- 
tion when Tc (the case temperature) Is within the 
range of 0°C-85°C. Tc may be measured in any en- 
vironment to determine whether the Intel486 micro- 
processor is within specified operating range. The 
case temperature should be measured at the center 
of the top surface opposite the pins. 

The ambient temperature (Ta) is guaranteed as long 
as Tc is not violated. The ambient temperature cap 
be calculated from ^jc and ^ja from the following 
equations. 

Tj = Tc + P * Bjc 
Ta = Tj - P * 0JA 
To = Ta + P * [0JA - Ojc] 



where Tj, Ta, Tc = Junction, Ambient and Case 
Temperature respectively. Ojc, ^ja = Junction-to- 
Case and Junction-to-Ambient Thermal Resistance, 
respectively. 

P = Maximum Power Consumption 

The values for ^ja and Ojc a"'© given in Table 14.2 
for the 1.75 sq. in., 168-pin, ceramic PGA. 

Table 14.3 shows the Ta allowable (without exceed- 
ing Tc) at various airflows and operating frequencies 

(fCLK). 

Note that Ta is greatly improved by attaching "fins" 
or a "heat sink" to the package. P (the maximum 
power consumption) is calculated by using the maxi- 
mum Ice at 5V as tabulated in the DC Characteris- 
tics of Section 1 3. 



Table 14.2.a. Tliermal Resistance (X/W) 0jc and ^ja for the 25 MHz and 33 MHz Intel486 CPU 





^JC 




0JA vs Airflow 


— ft/min (m/sec) 







(0) 


200 
(1.01) 


400 
(2.03) 


600 
(3.04) 


800 
(4.06) 


1000 
(5.07) 


Without Heat Sink 


1.5 


17 


14.5 


12.5 


11.0 


10.0 


9.5 


With Heat Sink* 


2.0 


13 


8.0 


6.0 


5.0 


4.5 


4.25 



*0.350" high unidirectional heat sink (AI alloy 6063, 40 mil fin width, 155 mil 
center-to-center fin spacing). 
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Table 14.2.b. Thermal Resistance (°C/W) 0jc and 0ja for the 50 MHz Intel486 CPU 





Ojc 




0JA vs Airflow- 


— ft/min (m/sec) 







(0) 


200 
(1.01) 


400 
(2.03) 


600 
(3.04) 


800 
(4.06) 


1000 
(5.07) 


Without Heat Sink 


1.5 


16.5 


14.0 


12.0 


10.5 


9.5 


9.0 


With Heat Sink* 


2.0 


12.0 


7.0 


5.0 


4.0 


3.5 


3.25 



*0.350" high unidirectional heat sink (Al 6063-T5, 40 mil fin width, 155 mil center to center fin spacing). 



Heat Sink Dimensions 
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Table 14.3. Maximum Ta at Various Airflows In °C 







Airflow-ft/min (m/sec) 




fCLK 
(MHz) 



(0) 


200 
(1.01) 


400 
(2.03) 


600 
(3.04) 


800 
(4.06) 


1000 
(5.07) 


Ta with Heat Sink 


25.0 


47 


64 


71 


75 


76 


77 


33.3 


36 


58 


67 


72 


74 


75 


50 


35 


60 


70 


75 


77.5 


78.75 


Ta without Heat Sink 


25.0 


31 


40 


47 


52 


55 


57 


33.3 


15 


27 


36 


42 


47 


49 


50 


10 


22.5 


32.5 


40 


45 


47.5 
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15.0 LOW POWER INTEL486TM DX 
MICROPROCESSOR 

• Lower Power Dissipation 

— Dynamic Frequency Scalability 

— IccCiTTiax) Reduced to 150 mA at 2 MHz 

— Improved Vcc Rating (±10%) 

• 168-Lead Pin Grid Array Package for Intel486 DX 
Microprocessor 

• High Performance Design 

— 25 MHz Operation for lntel486TM DX 

— 64 MByte/Sec Burst Bus 

— CHMOS IV Process Technology 

— Dynamic Bus Sizing for 8-, 1 6- and 32-Bit Bus- 
es 

This section describes the Low Power Intel486 DX 
microprocessor. 

The Low Power Intel486 Microprocessor meets to- 
day's need for high performance portables. The 
combination of special features like dynamic fre- 
quency scaling, lower minimum frequency, improved 
Vcc operation and high integration contribute signifi- 
cantly to lower power dissipation and meet the 
needs of portable computing. 

The Low Power capability is achieved by operating 
thei Intel486 Microprocessor in the 2X mode. The 
frequency can be varied dynamically between maxi- 
mum to minimum as needed. The frequency change 
does not affect contents of the registers and data 
integrity is maintained. Power dissipation is reduced 
significantly at 2 MHz where Ice is only 150 mA 
compared to 600 mA at 20 MHz. Low power ver- 
sions are offered for both the Intel486 SX and the 
Intel486 DX Microprocessors. 

The Low Power Intel486 Microprocessor is 100-per- 
cent compatible with ail versions of the lntel386TM 
Microprocessor family, assuring compatibility with 
the more than $50 billion software base of MS-DOS, 
Windows, OS/2 and UNIX/System operating system 
applications. The Low Power Intel486 Microproces- 
sor integrates the same RISC-technology, one clock 
per instruction integer core, on-chip cache, and 
memory management unit as the standard Intel486 
Microprocessor. 

Note that the Intel OverDriveTM Processor does not 
work in systems based on the Low Power Intel486 
CPU. 



The following section on the Low Power Intel 486 
DX Microprocessor contains information specific to 
the Low Power device only. All data not defined are 
located in the appropriate sections of this data sheet 
unless specified otherwise. 



15.1 Introduction 

The Low Power Intel486 Microprocessor brings In- 
tel486 technology and performance to the portable 
computer market. The low power capability is 
achieved by a frequency scalability feature during 
normal operation. The operating frequency can be 
brought down dynamically resulting in lower power 
supply current (Ice)- This results in minimal power 
dissipation which ensures a longer battery life. 

The Low Power Intel486 Microprocessor integrates 
the same RISC-technology, one clock per instruc- 
tion integer core, on-chip cache, and memory man- 
agement unit as the standard Intel486 Microproces- 
sor. 

The Low Power Intel486 Microprocessor has the fol- 
lowing special features: 

• Frequency Scalability — This is achieved by op- 
erating the Intel486 Microprocessor in the 2X 
clock mode. The frequency can be varied dynam- 
ically from maximum back to minimum or vice 
versa. The frequency change does not affect the 
register content of the CPU, thus data integrity is 
maintained. 

• Lower Minimum Frequency — The Low Power 
Intel486 Microprocessor can be operated at a 
minimum frequency of 2 MHz, at which lcc(fT^ax) 
is only 1 50 mA, compared to an lcc(iTiax) of 600 
mA at 20 MHz operation. The power dissipation is 
thus drastically reduced ensuring a longer battery 
life. 

• Improved Vcc Operation — The Low Power In- 
tel486 Microprocessor has an improved Vcc rat- 
ing of ±10%. Again this feature makes it ex- 
tremely attractive to portable battery powered ap- 
plications. 

The above three features ensure power savings for 
portable computer systems resulting in prolonged 
battery life. 

Besides the above special features, the Low Power 
Intel486 Microprocessor has an Identical feature set 
to the standard Intel486 CPU. This includes: 

• Binary Compatibility— The Low Power Intel486 
CPU is binary compatible with the 8086, 8088, 
80186, 80286, Intel386 SX, Intel386 DX, Intel486 
SX and Intel486 DX CPUs. 
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Full 32-Bit Integer Processor— The Low Power 
Intel486 CPU performs a complete set of arith- 
metic and logical operations on 8-, 1 6-, and 32-bit 
data types using a full-width ALU and eight gener- 
al-purpose registers. 

Separate 32-Bit Address and Data Paths- 
Four gigabytes of physical memory can be ad- 
dressed directly. 

Single-Cycle Execution — Many instructions ex- 
ecute in a single clock cycle. 

On-Chip Floating Point Unit— The 32-, 64-, and 
80-bit formats specified in IEEE standard 754 are 
supported. The unit is binary compatible with the 
8087, 80287, lntel387TM, |ntel387 SX. and In- 
tel487TM Math Coprocessors and the lntel486TM 
CPU. 

On-Chip Memory Management Unit— Address- 
management and memory-space protection 
mechanisms maintain the integrity of memory. 
This is necessary in multitasking and virtual-mem- 
ory environments, like those implemented by the 
UNIX and OS/2 operating systems. Both memory 
segmentation and paging are supported. 

On-Chip Cache with Cache Consistency Sup- 
port — The internal write-through cache can hold 
8 KBytes of data or instructions. Cache hits are 
as fast as read accesses to a processor register. 
Bus activity is tracked to detect alterations in the 
memory which internal cache represents. The in- 
ternal cache can be invalidated or flushed, so 
that an external cache controller can maintain 
cache consistency in multi-processor environ- 
ments. 

External Cache Control— Write-back and flush 
controls over an external cache are provided so 
that the processor can maintain cache consisten- 
cy in multi-processor environments. 

Instruction Pipelining — ^The fetching, decoding, 
execution and address translation of instructions 
are overlaped within the Low Power Intel486 Mi- 
croprocessor. This results in a continuous execu- 
tion rate of one clock cycle per instruction, for 
most instructions. 



• Burst Cycles — Burst transfers allow a new dou- 
bleword to be read from memory each clock cy- 
cle. With this capability the internal cache and in- 
struction prefetch buffer can be filled very rapidly. 

• Write Buffers — ^The processor contains write 
buffers to enhance the performance of consecu- 
tive writes to memory. The Low Power Intel486 
CPU can continue operations internally after a 
write, without waiting for the write to be executed 
on the external bus. 

• Bus Backoff— If another bus master needs con- 
trol of the bus during a Low Power Intel486 Mi- 
croprocessor initiated bus cycle, the Low Power 
Intel486 Microprocessor will float its bus signals, 
then restart its cycle when the bus becomes 
available again. 

• Instruction Restart— Programs can continue ex- 
ecution following an exception generated by an 
unsuccessful attempt to access memory. This 
feature is important for supporting demand-paged 
virtual memory applications. 

• Dynamic Bus Sizing — External controllers can 
dynamically alter the effective width of the data 
bus. Bus widths of 8, 16 or 32 bits can be used. 

The Low Power Intel386 DX Microprocessor pinout 
follows the same definition as the Intel486 DX Micro- 
processor given in Section 1 .0 except for those list- 
ed in Table 15.1. 

Table 15.1 



i486 DX 
Microprocessor 


Low Power i486 DX 
Microprocessor 


Pin# 


CLK 


CLK2 


C3 


NC 


CLKSEL 


A3(1) 



NOTE: 

1. This pin is TCK on the 50 MHz Intel486 DX Microproces- 
sor. 
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15.2 


Pinout 
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Figure 15.1. Low Power lntel486TM DX CPU Pinout (Top Side View) 
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Figure 15.2. Low Power lntel486TM DX CPU Pinout (Pin Side View) 
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15.3 Pin Cross Reference (lntel486TM DX CPU) 
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Ai3 Q10 


D11 


C1 


BS8# 


D16 


012 


K2 


H17 


Ai4 S5 


D12 


G3 


BS16# 


C17 


013 


K16 


K1 


Ai5 R7 


Di3 


D2 


CLK2 


C3 


G15 


LI 6 


K17 


A16 Q9 


D14 


K3 


CLKSEL 


A3 


R17 


M2 


LI 


Ai7 Q3 


D15 


F3 


D/C# 


M15 


S4 


M16 


L17 


A18 R5 


D16 


J3 


DPO 


N3 




P16 


Ml 


Ai9 Q4 


Di7 


D3 


DP1 


F1 




R3 


M17 


A20 Q8 


D18 


C2 


DP2 


H3 




R6 


P17 


A21 Q5 


Di9 


B1 


DP3 


A5 




R8 


02 


A22 07 


D20 


A1 


EADS# 


B17 




R9 


R4 


A23 S3 


D21 


B2 


FERR# 


014 




RIO 


S6 


A24 Q6 


D22 


A2 


FLUSH # 


015 




R11 


S8 


A25 R2 


D23 


A4 


HLDA 


P15 




R14 


S9 


A26 S2 


D24 


A6 


HOLD 


E15 






S10 


A27 S1 


D25 


B6 


IGNNE# 


A15 






S11 


A28 R1 


D26 


C7 


INTR 


A16 






S12 


A29 P2 


D27 


C6 


KEN# 


F15 






S14 


A30 P3 


D28 


C8 


LOCK# 


N15 








A31 Q1 


D29 


AS 


M/IO# 


N16 










D30 


C9 


NMI 


B15 










D31 


88 


PCD 
PCHK# 

PWT 

PLOCK# 

RDY# 

RESET 

W/R# 


J17 
017 
LI 5 
016 
F16 
016 
N17 









15.4 Pin Description 

All pin descriptions for the Low Power Intel486 DX Microprocessor follow the same definition as the Intei486 
DX Microprocessor with the exception of those listed in Table 15.2. 

Table 15.2 



Symbol 


Type 


Name and Function 


0LK2 


1 


CLK2 provides the fundamental timing for the Low Power Intel486 DX Microprocessor. 
This is twice the internal frequency of the OPU. 


OLKSEL 


1 


Clock Select pin selects the 2X mode required for the Low Power Intel486 OPU. A well 
defined pulse on this pin establishes the phase relationship of the 2X clock. With the 
exception of a pulse during cold reset, this pin should be driven low at all times and must 
be free of spikes or glitches. 
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OUTPUT PINS 

Table 15.3. lists all the output pins, indicating their 
active level, and when they are floated. 

Table 15.3. Output Pins 



Table 15.5. Input/Output Pins 



Name 


Active 
Level 


When Floated 


BREQ 


HIGH 




HLDA 


HIGH 




BE0#-BE3# 


LOW 


Bus Hold 


PWT, PCD 


HIGH 


Bus Hold 


W/R#,D/C#, 


HIGH/LOW 


Bus Hold 


M/IO# 






LOCK# 


LOW 


Bus Hold 


PLOCK# 


LOW 


Bus Hold 


ADS# 


LOW 


Bus Hold 


BLAST# 


LOW 


Bus Hold 


PCHK# 


LOW 




FERR# 


LOW 




A2-A3 


HIGH 


Bus, 
Address Hold 



INPUT PINS 

Table 1 5.4 lists all input pins, indicating their active 
level, and whether they are synchronous or asyn- 
chronous inputs. 

Table 15.4. Input Pins 



Klonrip 


Active 


Synchronous/ 




Level 


Asynchronous 


CLK2 






CLKSEL 






RESET 


HIGH 


Asynchronous 


HOLD 


HIGH 


Synchronous 


AHOLD 


HIGH 


Synchronous 


EADS# 


LOW 


Synchronous 


BOFF# 


LOW 


Synchronous 


FLUSH # 


LOW 


Asynchronous 


A20M# 


LOW 


Asynchronous 


BS16#,BS8# 


LOW 


Synchronous 


KEN# 


LOW 


Synchronous 


RDY# 


LOW 


Synchronous 


BRDY# 


LOW 


Synchronous 


INTR 


HIGH 


Asynchronous 


NMI 


HIGH 


Asynchronous 


IGNNE# 


LOW 


Asynchronous 



INPUT/OUTPUT PINS 

Table 15.5 lists all the input/output pins, indicating 
their active level and when they are floated. 



Name 


Active 
Level 


When Floated 


D0-D31 

DP0-DP3 

A4-A31 


HIGH 
•HIGH 
HIGH 


Bus Hold 

Bus Hold 

Bus, Address Hold 



Table 15.6. Test Pins 



Name 


Input or 
Output 


Sampled/ 
Driven On 


TCK 


Input 


N/A 


TDI 


Input 


Rising Edge of TCK 


TDO 


Output 


Falling Edge of TCK 


TMS 


Input 


Rising Edge of TCK 



Table 15.7. Component and Revision ID (PGA) 



i486 SX Microprocessor 

Low Power 

Stepping Name 


Component 
ID 


Revision 
ID 


DO 


04 


04 



NOTE: 

Table 15.7 shows the Component ID number and Revision 
ID number for the D-0 stepping of the Intel486 DX Micro- 
processor. When an Intel OverDrive Processor is installed 
in the system, the Component ID and Revision ID is provid- 
ed by the OverDrive Processor and not the Intel486 DX Mi- 
croprocessor. The Component ID and Revision ID read by 
the BIOS/software may change when a Performance Up- 
grade Component, such as the Intel OverDrive Processor, 
is installed in an Intel486 DX Microprocessor based sys- 
tem. 



15.5 Signal Description 

With the exception of CLK2 and CLKSEL, all signals 
follow the same definition as the Intel486 Microproc- 
essor. The A.C. timing parameters for all of these 
signals are given in Table 15.11. 

CLOCK (CLK2) 

CLK2 provides the fundamental timing for the Low 
Power Intel486 Microprocessor. It is divided by two 
internally to generate the internal processor clock 
used for instruction execution. The internal clock is 
comprised of two phases, "phase one" and "phase 
two". Each CLK2 period is a phase of the internal 
clock. Figure 15.3 illustrates the relationship. If de- 
sired, the phase of the internal processor clock can 
be synchronized to a known phase by ensuring the 
pulse on the CLKSEL pin meets the applicable tim- 
ings during cold boot (power-up reset). 
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lntel486^^CPU CLK 
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INTERNAL 
PROCESSOR CLOCK PERIOD 



CLK2 PERIOD 
$1 



CLK2 PERIOD 
02 



INTERNAL 
PROCESSOR CLOCK PERIOD 



CLK2 PERIOD 
01 



CLK2 PERIOD 
0)2 



Figure 15.3. CLK2 Signal and Internal Processor Clock 



All set-up, hold, float-delay and valid delay timings 
are referenced to the phase one of the clock. 

The internal processor clock (CLK) is similar to the 
clock signal of the standard Intel486 Microproces- 
sor. All I/O signals get sampled on the rising edge of 
this signal, i.e. the rising edge of phase one. Thus it 
Is important to synchronize the external circuitry with 
the phase one of CLK2. 

CLKSEL 

Clock Select pin selects the 2X mode required for 
the Low Power Intel486 DX CPU. This pin should be 
driven low after power-up and during the entire oper- 
ation of the CPU. However, a well defined pulse is 
required on CLKSEL pin during cold boot (power-up 



reset) to establish the phase relationship of the 2X 
clock. The reset pulse width during cold reset should 
be at least 1 ms. As shown in Figure 15.4, the pulse 
on CLKSEL should be asserted by the end of reset 
(approximately 0.9 ms after driving reset active) and 
at least 30 CLK2 periods before the falling edge of 
reset. 

Figure 15.5 shows the detailed timing definition of 
this pulse. The pulse on CLKSEL pin is only required 
during power-up reset. During all other times includ- 
ing warm resets the CLKSEL pin should be driven 
low and must be free of spikes or glitches. After the 
power-up reset, the system must track the phase of 
CLK2 at all times including during warm resets so 
that the Input/output signals can be sampled at the 
appropriate clock edge. The phase relationship is 
described In the next section. 
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Figure 15.4. CLKSEL Pulse with Reference to the Reset Puise Width 
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Figure 15.5. CLKSEL Timing Definition during Power-Up Reset 
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1 5.6 Architecture Overview 

The Low Power Intel486 DX Microprocessor is archi- 
tecturally similar to the Intel486 CPU. Thus all bus 
cycles follow the same definition The difference lies 
in the fact that the Low Power Intel486 CPU works 
with an external 2X clock input (CLK2). As shown in 
Figure 16-3, each of the internal processor clock 
(CLK) cycle is two CLK2 cycles wide. Thus a 25 MHz 
Low Power Intel486 DX Microprocessor needs a 
50 MHz clock input. 

CLK2 provides the fundamental timing for the Low 
Power Intel486 CPU. It is divided by two internally to 
generate the internal processor clock (CLK) used for 
instruction execution. The internal clock is com- 
prised of two phases, "phase one" and "phase 
two". Each CLK2 period is a phase of the internal 
clock. All Low Power Intel486 Microprocessor Inputs 
are sampled at the rising edge of phase 1 . Each bus 
cycle is comprised of at least two bus states, T1 and 
T2. Each bus state in turn consists of two CLK2 cy- 
cles phase 1 and phase 2 of the bus state. The bus 
state diagram in Section 7.2.13 is valid for the Low 
Power Intel486 Microprocessor. 

NOTE: 

The timing diagrams given in the Intel486 data 
sheet can be used for the Low Power Intel486 Mi- 
croprocessor. Read "CLK" signal as the internal 
clock of the CPU, with "CLK2" (the input clock of 
the Low Power Intel486 CPU) being twice the fre- 
quency of the internal processor clock as shown in 
Figure 15.3. 

The following describes how the input signals are 
sampled and output signals are referenced with re- 
spect to the input clock (CLK2): 

INPUT SIGNALS: 

The Low Power Intel486 CPU samples all its syn- 
chronous input signals (i.e. RDY#, BRDY#, 



BS8#, BS16#, KEN#, EADS#, BOFF#. HOLD 
and AHOLD) at the rising edge of phase 1 , as long 
as proper setup and hold times relative to that clock 
edge are met. 

The Low Power Intel486 CPU samples all its asyn- 
chronous input signals (i.e. RESET, INTR, NMI, 
A20M# FLUSH#, IGNNE#) at every other rising 
edge of the system clock (Phase 1), as long as prop- 
er setup and hold times relative to that clock edge 
are met. 

OUTPUT SIGNALS 

The A.C. timing specifications for output signals (i.e. 
valid and float delay timings) are specified with re- 
spect to the rising edge of the Phase 1 of the system 
clock. This holds true for all output signals Including 
ADS# and PCHK#. 



15.7 Variable CPU Frequency 

The Low Power Intel486 Microprocessor allows the 
CPU frequency to change dynamically. As shown in 
Figures 1 5.6 and 1 5.7, the relationship between fre- 
quency and power consumption is approximately lin- 
ear. Thus lowering the CPU frequency, reduces the 
power supply current (Ice) consumed by the CPU. 

The following must be satisified to change the CPU 
frequency: 

1 . Frequency can be changed at least 8 clocks after 
satisfying t4 (see Figure 15.5). The system can be 
started at a lower frequency and after satisfying 
the CLKSEL pulse specifications, it can be oper- 
ated at the required speed. 

2. The change in frequency should satisfy the mini- 
mum specification of "CLK2 high time" and 
"CLK2 low time". That is, at no time should the 
clock period go below the specified clock high 
and clock low times (see A.C. specifications for 
exact values). 
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Figure 15.6. Frequency vs lcc(tyP) (PGA Version) 
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Figure 15.7. Frequency vs lcc(tyP) (PQFP Version) 
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1 5.8 D.C./ A.C. Specifications 

Table 15.8 provides the absolute maximum ratings. It is a stress rating only and functional operation at the 
maximums is not guaranteed. Functional operating conditions are given in Section 15.8.1 D.C. Specifications 
and Section 1 5.8.3 A.C. Specifications. 

Table 15.8. Absolute Maximum Ratings 



Case Temperature under Bias 


-65*»Cto+110°C 


Storage Temperature 


-65°Cto+150°C 


Voltage on Any Pin with Respect to Ground 


- 0.5V to (Vcc+ 0.5V) 


Supply Voltage with Respect to Vss 


- 0.5V to + 6.5V 



15.8.1 D.C. SPECIFICATIONS 

Table 15.9 provides the D.C. operating conditions for the Low Power Intel486 DX Microprocessor. 
Functional operating range: Vcc = 5V ±10%; Tcase = 0**C to +85°C. 

Table 15.9. Low Power intei486 DX Microprocessor D.C. Parametric Values (PGA Version) 



Symbol 


Parameter 


Min 


Max 


Unit 


Notes 


V|L 


Input Low Voltage 


-0.3 


+ 0.8 


V 




V|H 


Input High Voltage 


2.0 


Vcc + 0-3 


V 




Vol 


Output Low Voltage 




0.45 


V 


(Notel) 


VOH 


Output High Voltage 


2.4 




V 


(Note 2) 


'cc 


Power Supply Current 
CLK2 = 50 MHz 




700 


mA 


(Note 3) 


III 


Input Leakage Current 




±15 


^lA 


(Note 4) 


l|H 


Input Leakage Current 




200 


;xA 


(Note 5) 


l|L 


Input Leakage Current 




-400 


IxA 


(Note 6) 


Ilo 


Output Leakage Current 




±15 


IxA 




C|N 


Input Capacitance 




20 


PF 


Fc = 1 MHz(7) 


Co 


I/O or Output Capacitance 




20 


PF 


Fc = 1 MHz(7) 


CcLK 


CLK Capacitance 




20 


pF 


Fc = 1 MHz(7) 



NOTES: 

1 . This parameter is measured at: 
Address, Data BEn 4.0 mA 
Definition, Control 5.0 mA 

2. This parameter is measured at: 
Address, Data BEn - 1 .0 mA 
Definition, Control -0.9 mA 

3. Typical supply current 

Ice = 550 mA @CLK2 = 50 MHz 

4. This parameter is for inputs without pullups or pulldowns and ^ V|n ^ Vcc- 

5. This parameter is for inputs with pulldowns and Vm = 2.4V. 

6. This parameter is for inputs with pullups and V|l = 0.45V. 

7. Not 100% tested. 
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15.8.2 POWER SUPPLY CURRENT vs FREQUENCY 

Following is the power consumption of the Low Power Intel486 Microprocessor installed in a low power system 
for different frequencies. 

Table 15.10. Power Supply Current (Ice) Values over Frequencies of Operation (PGA Version) 



CLK2 Frequency 
(MHz) 


Operating Frequency 
(MHz) 


lcC(max) 
(mA) 


'cC(typ) 
(mA) 


4 


2 


150 


100 


16 


8 


325 


235 


32 


16 


525 


400 


40 


20 


600 


475 


50 


25 


700 


550 



15.8.3 A.C. SPECIFICATIONS 

The following table provides the A.C. specifications for the Low Power Intel486 DX Microprocessor. It consists 
of output delays, Input setup requirements and Input hold requirements. All A.C. specifications are relative to 
the rising edge of the phase 1 of the input system clock (CLK2), unless otherwise specified. 



Vcc = 5V 


Table 15.11. Low Power Intel486 DX— 25 MHz Microprocessor A.C. Characteristics 

±10%; TcASE = 0°C to +85°C; Cl = 50 pF(2) unless otherwise specified 


Symbol 


Parameter 


Min 


Max 


Unit 


Figure 


Notes 




Frequency 


2 


25 


MHz 




Half of CLK2 Frequency 


ti 


CLK2 Period 


20 


250 


ns 


15.8 




t2 


CLK2 High Time 


7 




ns 


15.8 


At2V 


t3 


CLK2 Low Time 


7 




ns 


15.8 


At 0.8V 


t4 


CLK2 Fall Time 




2 


ns 


15.8 


2V to 0.8V 


t5 


CLK2 Rise Time 




2 


ns 


15.8 


0.8V to 2V 


t6 


A2-A31, PWT, PCD, BE0-3#, 
M/IO#, D/C#, W/R#, ADS#, LOCK#, 
FERR#. BREQ, HLDA Valid Delay 


3 


22 


ns 


15.9 




t? 


A2-A31, PWT, PCD, BE0-3#, 
M/IO#,D/C#,W/R#,ADS#, 
LOCK# Float Delay 




30 


ns 


15.9 


After Clock Edged) 


t8 


PCHK# Valid Delay 


3 


27 


ns 


15.9 




tea 


BLAST#. PLOCK# Valid Delay 


3 


27 


ns 


15.10 
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Table 15.11. Low Power Intel486 DX— 25 MHz Microprocessor A.C. Characteristics (Continued) 
Vcc = 5V ±10%; TcASE = 0°C to +85°C; Cl = 50 pF(2) unless othenA^ise specified 



Symbol 


Parameter 


Min 


Max 


Unit 


Figure 


Notes 


tg 


BLAST #,PLOCK# 
Float Delay 




30 


ns 


15.9 


After Clock Edged) 


tio 


D0-D31,DP0-3 Write Data 
Valid Delay 


3 


22 


ns 


15.9 




tii 


D0-D31, DPO-3 Write Data 
Float Delay 




30 


ns 


15.9 


After Clock EdgeO) 


tl2 


EADS# Setup Time 


9 




ns 


15.10 




tl3 


EADS# Hold Time 


4 




ns 


15.10 




tl4 


KEN#.BS16#.BS8# 
Setup Time 


9 




ns 


15.10 




tl5 


KEN#,BS16#,BS8# 
Hold Time 


4 




ns 


15.10 




tl6 


RDY#,BRDY# Setup Time 


9 




ns 


15.10 




tl7 


RDY#,BRDY# Hold Time 


4 




ns 


15.10 




tl8 


HOLD, AHOLD, BOFF# 
Setup Time 


11 




ns 


15.10 




tl9 


HOLD, AHOLD, BOFF# 
Hold Time 


4 




ns 


15.10 




t20 


RESET, FLUSH #, A20M#, NMI, 
INTR,IGNNE# Setup Time 


11 




ns 


15.10 




t21 


RESET, FLUSH#, A20M#, NMI, 
INTR,IGNNE# Hold Time 


4 




ns 


15.10 




t22 


D0-D31, DPO-3, A4-A31 
Read Setup Time 


6 




ns 


15.10 




t23 


D0-D31, DPO-3, A4-A31 
Read Hold Time 


4 




ns 


15.10 






CLKSEL 


See Figures 15.4 and 15.5 for details on this signal. 
Figure 1 5.5 shows minimum timings required for the 
proper operation of the CPU. The pulse on CLKSEL can 
be of any length as long as the minimums are satisfied 
and the transitions from low to high occurs at the clock 
edge shown. 



NOTES: 

1. Not 100% tested, guaranteed by design characterization. 

2. All timing specifications assume C|_ = 50 pF. 



222 



inlel^ 



lntel486TM dX MICROPROCESSOR 



[p[^iLDR!ilDKlA[^V 



-4>1 ■ 



H <f2 




-. 12- 




-H t4 
— 11 — 




240440 -B2 



Figure 15.8. CLK2 Waveform 
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Figure 15.9. Setup and Hold Timings 
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16.0 SUGGESTED SOURCES FOR 
INTEL486TM ACCESSORIES 

Following are some suggested sources of accesso- 
ries for the Intel486. They are not an endorsement 
of any kind, nor a warranty of the performance of 
any of the listed products and/or companies. 

Sockets 

1. McKenzie Technology 
44370 Old Palmspring Blvd. 
Fremont, CA 94538 

Tel: (415)651-2700 

2. E-CAM Technology, Inc. 
14455 North Hayden Rd. 
Suite 208 

Scottsdale, AZ 85260 
Tel: (602)443-1949 

3. Augat Inc. (for sockets with decaps) 
Interconnection Products Group 

33 Perry Ave. 
P.O. Box 779 
Attleboro, MA 02703 
Tel: (508) 222-2202 



Heat Sinks/Fins 

1 . Thermalloy Inc. 

2021 West Valley View Lane 
Dallas, TX 75381-0839 
Tel: (214) 243-4321 

2. E G & G Division 
60 Audubon Road 
Wakefield, MA 01880 
Tel: (617) 245-5900 

TIL Crystals/Oscillators 

1. NFL Frequency Controls, Inc. 
357 Beloit Street 
Burlington, Wl 53105 

Tel: (414) 763-3591 

2. M-Tron 

P.O. Box 630 
Yankton, SD 57078 
Tel: (605) 665-9321 



Debugging Tower 

1 . Emulation Technology 
2344 Walsh Ave., Building F 
Santa Clara, CA 95051 
Tel: (408) 982-0664 
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17.0 REVISION HISTORY 

Revision -003 of the Intel486 CPU data sheet con- 
tains many updates and improvements to the origi- 
nal version. A revision summary of major changes is 
listed below: 

The sections significantly revised since version -001 
are: 

Section 2.1.2 The polarity and names of the two 
cache control bits in Control Regis- 
ter (CRO) have been modified. 
The Cache Enable (CE) and Writes 
Transparent (WR) have been re- 
named Cache Disable (CD) and Not 
Write Through (NW). The value of 
CRO after RESET has been 
changed to reflect the polarity 
change. 

Section 6.2.15 The discussion of A20M# has been 
clarifed. During the falling edge of 
RESET, A20M# should be high, for 
proper operation of the CPU. 

Section 6.5 The value of CRO after RESET has 
been modified. 

Section 6.5.1 Figure 6.3, "Pin State during RE- 
SET" is added. This Figure is a gen- 
eral reference for Reset issues. Pre- 
vious Figures 8.1, 8.2, and 8.8 have 
been deleted, since Figure 6.3 now 
contains Reset information. 

Section 7.2.10 A discussion of addresses and byte 
enables driven during INTA cycles 
has been added. 

Section 10.1 Clock counts and opcodes have 
been clarified and corrected. 

Section 10.1 The opcode slot for CMPXCHG in- 
struction has been moved from 
0FA6/A7to0FB0/B1. 

Section 12.2 Table 12.1 has been enhanced. The 
"Case Temperature under Bias" 
spec was Improved. The "Supply 
Voltage with Respect to Vss" spec 
was added. 

Section 12.3 Maximum Ice values have been im- 
proved to 700 mA at 25 MHz and 
900 mA at 33 MHz. 

Section 12.3 Typical Ice values have been modi- 
fied to 550 mA at 25 MHz and 
700 mA at 33 MHz. 

Section 12.3 C|n, Cq, and Cclk values have 
been changed to 20 pF. Testing pa- 
rameters and Note 7 were added. 



Section 12.4 The A.C. Specifications have been 
improved. Float delays were im- 
proved at both 25 MHz and 33 
MHz. Note 1 was added to the float 
delays. Maximum valid delays were 
reduced at 33 MHz. 

Section 12.5 The ICD section was enhanced. 

Section 13.1 Thermal resistance ^CA values of 
the 168-pin ceramic package have 
been corrected. 

Section 13.1 Maximum ambient temperatures 
have been corrected to use the 
max Ice values. 

The sections significantly revised since version -002 



are: 

Section 2.1.2.1 

Table 2.16 



Spec change for PC and PWT bits. 

Value of Intel Reserved Interrupt 
Vector assignment corrected to 
•18-31'. 

Section 3.1 Added CMPCHG, XADD instruc- 
tions in the table. 

Section 3.5 Added explanation about NMI not 
able to bring out the processor from 
shutdown under certain conditions. 

Section 4.4.6 Value of task switching time cor- 
rected to 1 ms. 

Section 4.5.4 Specification change for PCD and 
PWT bits. 

Section 5.6 Specification change for PCD and 
PWT bits. 

Section 5.7 Cache flushing procedure ex- 
plained, when FLUSH # applied 
synchronously or asynchronously. 

Section 6.2.5 Specification change for PLOCK 
cycle. 

Section 6.2.8 Added explanation for warm boot- 
up. 

Section 6.2.12 Specification change for PCD and 
PWT bits. 

Section 6.2.13 Explanation added for FERR# be- 
havior. 

Section 6.2.14 Explanation added of IGNNE# be- 
havior. 

Section 6.2.15 Explanation added for A20M# be- 
havior in protected mode and dur- 
ing RESET. 

Section 6.3 Simplified example for read reor- 
dering in write buffers. 

Section 6.3.1 Corrected REP OUTS instruction. 

Section 6.3.2 Added explanation about cache up- 
date on read-modify-write cycle. 
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Section 6.5 Added RESET pulse length require- 
ment with or without BIST 

Section 6.5 Added table for Intel486 revision 
ID. 

Table 6.2 Corrected CRO value after Reset. 

Figure 6.3 Corrected pin state diagram during 

RESET. RESET pulse length 
changed to 15 CLKs. 

Section 7.2.2.3 Added explanation to terminate 
burst cycle. 

Section 7.2.3.4 Clarified text on changing KEN# 
during cache line fill. 

Figure 7.12 Corrected timing diagram to show 
A4-A31, M/IO#, D/C#, W/R# do 
not change during burst. 

Figure 7.13 Corrected timing diagram to show 
A4-A31, M/IO#, D/C#, W/R# do 
not change during burst. 

Figure 7.14 Corrected timing diagram to show 
A4-A31, M/IO#, D/C#, W/R# do 
not change during burst. 

Section 7.2.4.2 Added cases that follow burst or- 
der. 

Section 7.2.6 Added explanation for read-modify- 
write for un-aligned transfers. 

Section 7.2.7 HOLD latency decreased by provid- 
ing window in PLOCK cycle (speci- 
fication change). 

Section 7.2.8 Added explanation about EADS# 
timing. 

Section 7.2.8 Added the case of invalidation with 
BOFForHOLD. 

Figure 7.22 Change in Timing Diagram for 
BREQ. 

Figure 7.23 Change in Timing Diagram for 
BREQ. 

Figure 7.25 Change in Timing Diagram for 
RDY#/BRDY#. 

Section 7.2.9 Added explanation about HOLD 
getting recognized during unaligned 
writes. 

Section 7.2.11 Added status of address and data 
busses during special bus cycles. 

Section 7.2.11 Added sections on Halt and Shut- 
down cycles. 

Figure 7.30 Corrected state diagram by AN Ding 
BRDY# and BLAST# for the last 
transfer of the burst cycle. 

Section 7.2.14 Difference in FERR# and ER- 
ROR # explained. 

Section 8.1 Changed Reset width to 15 CLKs. 



Section 8.4 Added explanation on tri-state 
status. 

Table 10.1 Corrected value in format. 

Section 11.0 Added Note 6 on FERR# and 
ERROR # difference. 

Section 11.0 Added TLB replacement algorithm 
for 386 DX. 

Section 12.3 Corrected values in Note 2. 

Section 12.3 Added "internal" for pullup and 

pulldown resistors 
Figure 12.2 & Waveforms for input and output sig- 
Figure 12!3 "^'^ ^^^® ^®®" re-drawn to show 

details about set-up, hold and float 

times. 

Section 13.1 Added details about Ta calculation 

from Ojc and ^ja- 
Section 14.0 Added new section on suggested 

sources of Intel486 accessories 

like sockets, debugging tower, heat 

sinks, etc. 

The sections significantly revised since revision -003 
are: 

Cover Page Add 50 MHz information to text and 
block diagram. 

Added 50 MHz pinout diagrams. 



Figure 1.3 
and Figure 1.4 

Pin Cross 

Reference 

Table 

Quick Pin 
Reference 

Table 1.4 



Added column for Test Access Port 
pins. 



Added Test Access Port pin de- 
scriptions. 

Added Test Access Port pin sam- 
ple/driven data. 

Table 1.5 Added DO, cAx, and cBx revision ID 

information. 

Section 6.2.9 Added description of HOLD recog- 
nition during BOFF#. 

Section 6.2.12 Added PCD and PWT description 
when paging disabled. 

Section 6.2.16 Added signal description for Test 
Access Port signals. 

Table 6.3 Added DO, cAx, and cBx revision ID 

information. 

Figure 6.4 Added additional details on signal 

samping during RESET. 

Figure 7.30 Added HOLD to state transition be- 
tween Tb and T1 b. 

Section 8.0, 8.5 Added Boundary Scan to test fea- 
ture description. 

Table 12.2 Added 50 MHz D.C. specifications. 

Table 12.3 Added 50 MHz A.C. specifications. 
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Figure 12.7 Added Test signal timing reference 
diagram. 

Figure 12.4.2 Added 50 MHz capacltlve load de- 
rating curves. 

Table 13.2 Added 50 MHz thermal resistance 

values. 

Table 13.3 Added 50 MHz ambient tempera- 

ture data. 

The sections significantly revised since revision -004 
are: 

Intel OverDrive Processor information/specifications 
have been added throughout the document. Section 
13.0 contains OverDrive Processor specific informa- 
tion. 

Low Power Intel486 DX CPU information/specifica- 
tions have been added. Section 15.0 contains Low 
Power specific information. 



Quick Pin Reference 
Table 1-5 
Section 6.2.15 

Figure 6.4 
Section 7.2.15 

Section 8.1 

Section 8.5.7 
Table 10.1 

Table 10.2 
Table 10.3 
Appendix A 



Clarified the description for 
KEN#. 

Updated component and revi- 
sion I.D. information. 

More clearly defined A20M# 
bit by defining functionality 
during I/O writes, prefetching, 
etc. 

Designated that FLUSH # 
must be inactive during BIST. 

Added section for floating 
point error handling in AT 
compatible systems. 

Clarified A20M#, FLUSH # 
and AHOLD functionality dur- 
ing BIST. 

BSDL is now available through 
Intel. 

Clarified CBW and CWD. Cor- 
rected REP LODS, REP 
MOVS and REP STOS. 

Corrected REP INS and REP 
OUTS. 

Corrected FSTP, FUCOMP, 
FSUBR, FDIV, FDIVR. 

Added appendix for CPU Iden- 
tification Code. 
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APPENDIX A 
INTEL RECOMMENDED CPU IDENTIFICATION CODE 



The CPU identification assembly code will determine for the user which Intel microprocessor and if a Intel Math 
Coprocessor is installed in the system. If a 486 microprocessor has been installed, the program will determine 
if the CPU is with/without a floating point unit. This code should be executed so the system can be configured 
for a particular application, which may depend on the microprocessor and Math Coprocessor installed in the 
system. 



TITLE CPUID 


DOSSEG 




•model 


small 


.stack 


lOOh 


.data 




fp_status 


dw 


id_mess 


db 


fp.8087 


db 


fp«80287 


db 


fp»80387 


db 


C8086 


db 


c286 


db 


c386 


db 


0486 


db 


c486nfp 


db 


period 


db 


present«86 


dw 


present_286 


dw 


present_386 


dw 


present_486 


dw 



"This system has a$" 

"and an 8087 Math Coprocessor}" 

"and an 287tm Math CoProcessorJ" 

"and an 387tm Math CoProcessorJ" 

"n8086/8088 microprocessor?" 

"n80286 microprocessor}" 

"386TM microprocessor}" 

"486TM DX microprocesser/487TM sXtm Math 

"Coprocessor}" 

"486TM SXTM Microprocesser}" 

".}",13,10 











The purpose of this code is to allow the user the ability to identify 
the processor and coprocesor that is currently in the system. The 
algorithm of the program is to first determine the processor id. 
When that is accomplished, the program continues to then identify 
whether a coprocessor exists in the system. If a coprocessor or 
integrated coprocessor exists, the program will identify the 
coprocessor id. If one does not exist, the program then terminates. 



.code 



start J 



mov ax,@data 

mov ds,ax 

mov dx, offset id_mess 

mov ah,9h 

int 21h 



; set segment register 
;print header message 
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; 8086 check 










; Bits 12-15 are always set on 


the 8086 processor. 


» 

pushf 






• save EFLAGS 


pop 


bx 




store EFLAGS in BX 


mov 


ax,Offfh 




clear bits 12-15 


and 


ax,bx 




in EFLAGS 


push 


ax 




store new EFLAGS value on stack 


popf 






replace current EFLAGS value 


pushf 






set new EFLAGS 


pop 


ax 




store new EFLAGS in AX 


and 


ax,OfOOOh 




if bits 12-15 are set, then CPU 


cmp 


ax,OfOOOh 




is an 8086/8088 


mov 


dx, offset C8086 




store 8086/8088 message 


mov 


present«86,l 




turn on 8086/8088 flag 


je 


check_fpu 




if CPU is 8086/8088, check for 
8087 




80286 CPU Check 








Bits 12-15 are always clear on the 


80286 processor. > 


or 


bx,OfOOOh 




try to set bits 12-15 


push 


bx 






popf 








pushf 








pop 


ax 






and 


ax,OfOOOh 




if bits 12-15 are cleared, then 


mov 


dx, offset c286 




CPU is an 80286 


mov 


present_86,0 




turn off 8086/8088 flag 


mov 


present-286,1 




turn on 80286 flag 


J2 


check_fpu 




if CPU is 80286, check for 80287 




386 CPU check 










The AC bit, bit #18, is a new 


bit introduced in the EFLAGS register | 




on the 486 DX 


CPU to generate 


aligr 


iment faults. This bit can be set 




on the 486 DX 


CPU, but not on 


the 386 CPU. 


mov 


bx,sp 




; save current stack pointer to 
; align it 


and 


sp,not 3 




; align stack to avoid AC fault 


db 


66h 






pushf 






; push original EFLAGS 


db 


66h 






pop 


ax 




; get original EFLAGS 


db 


66h 






mov 


ex, ax 




; save original EFLAGS 


db 


66h 




; xor EAX,40000h 


xor 


ax,0 




; flip AC bit in EFLAGS 


dw 


4 




; upper 16-bits of xor constant 


db 


66h 






push 


ax 




; save for EFLAGS 


db 


66h 






popf 






; copy to EFLAGS 
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db 


66h 




pushf 




; push EFLAGS 


db 


66h 




pop 


ax 


; get new EFLAGS value 


db 


66h 




xor 


ax, ex 


; if AC bit cannot be changed, 
; CPU is 


mov 


dx, offset c386 


; store 386 message 


mov 


present_286,0 


; turn off 80286 flag 


mov 


present_386,l 


; turn on 386 flag 


je 


check_fpu 


; if CPU is 386, now check for 
; 80287/80387 




486 DX CPU and 486 DX CPU w/o FPU checking 


mov 


dx, offset c486nfp 


; store 486NFP message 


mov 


present_386,0 


; turn off 386 flag 


mov 


present_486,l 


; turn on 486 flag 




Co-processor 


checking begins here for the 8086/80286/386 CPUs. 




The algorithm 


is to determine whether or not the floating-point 




status and control words can be 


written to, the correct coprocessor 




is then determined depending on 


the processer id. Coprocessor checks 




are first performed for an 8086, 


80286 and a 486 DX CPU. If the 




coprocessor id is still undetermined, the system must contain a 386 | 




CPU. The 386 


CPU may work with either an 80287 or an 80387. The 




infinity of the coprocessor must 


. be checked to determine the correct 




coprocessor id. 




cheGk_fpu: 




; check for 8087/80287/80387 


fninit 




; reset FP status word 


mov 


fp^status,5a5ah 


; initialize temp word to non-zero 
; value 


fnstsw 


fp_status 


; save FP status word 


mov 


ax,fp_status 


; check FP status word 


cmp 


al,0 


; see if correct status with 
; written 


jne 


print^one 


; jump if not Valid, no NPX 
; installed 


fnstcw 


fp_status 


; save FP control word 


mov 


ax,fp_status 


; check FP control word 


and 


ax,103fh 


; see if selected parts looks OK 


cmp 


ax,3fh 


; check that ones and zeroes 
; correctly read 


jne 


print_one 


; jump if not Valid, no NPX 
; installed 


cmp 


present_486,l 


; check if 486 flag is on 


je 


is_486 


; if so, jump to print 486 message 


jmp 


not«486 


; else continue with 386 checking 


is_486: 






mov 


dx, offset c486 


; store 486 message 


jmp 


print_one 
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not«486: 










cmp 


present»386,l 


check if 386 flag is on 




jne 


print.87_287 


if 386 flag not on, check NPX for 
8086/8088/80286 




mov 


ah,9h 


print out 386 CPU ID first 




int 


21h 




; 80287/80387 check for the 386 CPU 






fldl 




must use default control from 
FNINIT 




fldz 




form infinity 




fdiv 




8087/80287 says +inf = inf 




fid 


St 


form negative infinity 




fchs 




80387 says +inf <> -inf 




fcompp 




see if they are the same and 
remove them 




fstsw 


fp_status 


look at status from FCOMPP 




mov 


ax,fp_status 






mov 


dx, offset fp_.80287 


store 80287 message 




sahf 




see if infinities matched 




jz 


restore_EFLAGS 


jump if 8087/80287 is present 




mov 


dx, offset fp_80387 


store 80387 message 


restore_EFLAGS: 










finit 




clear any pending fp exception 




mov 


ah,9h 


print NPX message 




int 


21h 






db 


66h 






push 


ex 


push ECX 




db 


66h 






popf 




• restore original EFLAGS register 




mov 


sp,bx 


• restore original stack pointer 




jmp 


exit 




print.one : 










mov 


ah,9h 


• print out CPU ID with no NPX 




int 


21h 






jmp 


exit 




print_87-287: 










mov 


ah,9h 


; print out 8086/8088/80286 first 




int 


21h 






cmp 


present_86,l 


; if 8086/8088 flag is on 




mov 


dx, offset fp_8087 


; store 8087 message 




je 


print_fpu 






mov 


dx, offset fp«80287 


; else CPU = 80286, store 80287 
; message 


print_fpu: 










mov 


ah,9h 


; print out NPX 




int 


21h 






jmp 


exit 




exit : 










mov 


dx, offset period 


; print out a period of end message 




mov 


ah,9h 






int 


21h 






mov 


ax,4c00h 


; terminate program 




int 


21h 






end 


start 
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Arrow/Schweber Electronics 
9511 Ridgehaven Court 
San Diego 92123 
Tel: (619) 565-4800 
FAX: (619) 279-8062 

Arrow/Schweber Electronics 
1180 Murphy Avenue 
San Jose 95131 
Tel: (408) 441-9700 
FAX: (408) 453-4810 

Arrow/Schweber Electronics 
2961 Dow Avenue 
Tustin 92680 
Tel: (714) 838-5422 
FAX: (714) 838-4151 

Avnet Computer 
3170 Pullman Street 
Costa Mesa 92626 
Tel: (714) 641-4150 
FAX: (714) 641-4170 



Avnet Computer 
1361B West 190th Street 
Gardena 90248 
Tel: (800) 426-7999 
FAX: (310) 327-5389 

Avnet Computer 
755 Sunrise Blvd., #150 
Roseville 95661 
Tel: (916) 781-2521 
FAX: (916) 781-3819 

Avnet Computer 
1175 Bordeaux Drive, #A 
Sunnyvale 94089 
Tel: (408) 743-3304 
FAX: (408) 743-3348 

Hamilton/Avnet 
3170 Pullman Street 
Costa Mesa 92626 
Tel: (714) 641-4100 
FAX: (714) 754-6033 

Hamilton/Avnet 
1175 Bordeaux Drive, #A 
Sunnyvale 94089 
Tel: (408) 743-3300 
FAX: (408) 745-6679 

Hamilton/Avnet 
4545 Viewridge Avenue 
San Diego 92123 
Tel: (619) 571-1900 
FAX: (619) 571-8761 

Hamilton/Avnet 
21150 Calife St. 
Woodland Hills 91367 
Tel: (818) 594-0404 
FAX: (818) 594-8234 

Hamilton/Avnet 

755 Sunrise Avenue, #150 

Roseville 95661 

Tel: (916) 925-2216 

FAX: (916) 925-3478 

Pioneer Technologies Group 
134 Rio Robles 
San Jose 95134 
Tel: (408) 954-9100 
FAX: (408) 954-9113 

Wyle Laboratories 
15360 Ban-anca Pkwy. 
In/ine 92713 
Tel: (714) 753-9953 

Wyle Laboratories 
2951 Sunrise Blvd., #175 
Rancho Cordova 95742 
Tel: (916) 638-5282 
FAX: (916) 638-1491 

Wyle Laboratories 
9525 Chesapeal(e Drive 
San Diego 92123 
Tel: (619) 565-9171 
FAX: (619) 365-0512 

Wyle Laboratories 
3000 Bowers Avenue 
Santa Clara 95051 
Tel: (408) 727-2500 
FAX: (408) 727-5896 

Wyle Laboratories 
17872 Cowan Avenue 
Irvine 92714 
Tel: (714) 863-9953 
FAX: (714) 263-0473 

Wyie Laboratories 
26010 Mureau Road, #150 
Caiabasas 91302 
Tel: (818) 880-9000 
FAX: (818) 880-5510 

COLORADO 

Arrow/Schweber Electronics 
61 Inverness Dr. East, #105 
Englewood 80112 
Tel: (303) 799-0258 
FAX: (303) 373-5760 



Wyle 
451 E 



Hamilton/Avnet 
9605 Maroon Circle, #200 
Englewood 80112 
Tel: (303) 799-7800 
FAX: (303) 799-7801 

vie Laboratories 
^51 E. 124th Avenue 
Thornton 80241 
Tel: (303) 457-9953 
FAX: (303) 457-4831 

CONNECTICUT 

Arrow/Schweber Electronics 
12 Beaumont Road 
Wallingford 06492 
Tel: (203) 265-7741 
FAX: (203) 265-7988 

Avnet Computer 
55 Federal Road, #103 
Danbury 06810 
Tel: (203) 797-2880 
FAX: (203) 791-9050 

Hamilton/Avnet 
55 Federal Road, #103 
Danbury 06810 
Tel: (203) 743-6077 
FAX: (203) 791-9050 

Pioneer-Standard 
2 Trap Falls Rd., #101 
Shelton 06484 
Tel: (203) 929-5600 
FAX: (203) 838-9901 

FLORIDA 

Arrow/Schweber Electronics 
400 Fainvay Drive, #102 
Deerfield Beach 33441 
Tel: (305) 429-8200 
FAX: (305) 428-3991 

Arrow/Schweber Electronics 
37 Skyline Drive, #3101 
Lake Mary 32746 
Tel: (407) 333-9300 
FAX: (407) 333-9320 

Avnet Computer 
3343 W. Commercial Blvd. 
BkJg. C/D, Suite 107 
Ft. Lauderdale 33309 
Tel: (305) 979-9067 
FAX: (305) 730-0368 

Avnet Computer 
3247 Tech Drive North 
St. Petersburg 33716 
Tel: (813) 573-5524 
FAX: (813) 572-4324 

Hamilton/Avnet 
5371 N.W. 33rd Avenue 
Ft. Uuderdale 33309 
Tel: (305) 484-5016 
FAX: (305) 484-8369 

Hamilton/Avnet 
3247 Tech Drive North 
St. Petersburg 33716 
Tel: (813) 573-3930 
FAX: (813) 572-4329 

Hamilton/Avnet 
7079 University Boulevard 
Winter Pari< 32791 
Tel: (407) 657-3300 
FAX: (407) 678-1878 

Pioneer Technologies Group 
337 Northlake Blvd., #1000 
Alta Monte Springs 32701 
Tel: (407) 834-9090 
FAX: (407) 834-0865 

Pioneer Technologies Group 
674 S. Military Trail 
Deerfield Beach 33442 
Tel: (305) 428-8877 
FAX: (305) 481-2950 



GEORGIA 

Arrow Commercial Systems Group 

3400 C. Corporate Way 

Duluth 30136 

Tel: (404) 623-8825 

FAX: (404) 623-8802 

Arrow/Schweber Electronics 

4250 E. Rivergreen Pkwy., #E 

Duluth 30136 

Tel: (404) 497-1300 

FAX: (404) 476-1493 

Avnet Computer 

3425 Corporate Way, #G 

Duluth 30136 

Tel: (404) 623-5452 

FAX: (404) 476-0125 

Hamilton/Avnet 
3425 Corporate Way, #G 
Duluth 30136 
Tel: (404) 446-0611 
FAX: (404) 446-1011 

Pioneer Technologies Group 
4250 C. Rivergreen Parkway 
Duluth 30136 
Tel: (404) 623-1003 
FAX: (404) 623-0665 



ILLINOIS 

Arrow/Schweber Electronics 

1140W.ThorndaleRd. 

Itasca 60143 

Tel: (708) 250-0500 

Avnet Computer 
1124 Thorndale Avenue 
Bensenville 60106 
Tel: (708) 860-8573 
FAX: (708) 773-7976 

Hamilton/Avnet 
1 130 Thorndale Avenue 
Bensenville 60106 
Tel: (708) 860-7700 
FAX: (708) 860-8530 

MTI Systems 

1 140 W. Thorndale Avenue 

Itasca 60143 

Tel: (708) 250-8222 

FAX: (708) 250-8275 

Pioneer-Standard 
2171 Executive Dr., #200 
Addison 60101 
Tel: (708) 495-9680 
FAX: (708) 495-9831 



INDIANA 

Arrow/Schweber Electronics 
7108 Lakeview Parkway West Dr. 
Indianapolis 46268 
Tel: (317)299-2071 
FAX: (317) 299-2379 

Avnet Computer 
485 Gradle Drive 
Carmel 46032 
Tel: (317) 575-8029 
FAX: (317) 844-4964 

Hamilton/Avnet 
485 Gradle Drive 
Carmel 46032 
Tel: (317) 844-9333 
FAX: (317) 844-5921 

Pioneer-Standard 
9350 Priority Way West Dr. 
Indianapolis 46250 
Tel: (317) 573-0880 
FAX: (317) 573-0979 
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IOWA 

Hamitton/Avnet 
2335A Blairsferry Rd., N.E. 
Cedar Rapids 52402 
Tel: (319) 362-4757 
FAX: (319) 393-7050 

KANSAS 

Arrow/Schweber Electronics 
9801 Legler Road 
Lenexa 66219 
Tel: (913) 541-9542 
FAX: (913) 541-0328 

Avnet Computer 
15313 W. 95th Street 
Lenexa 61219 
Tel: (913) 541-7989 
FAX: (913) 541-7904 

Hamllton/Avnet 
15313 W. 95th 
Overland Park 66215 
Tel: (913) 888-1055 
FAX: (913) 541-7951 

KENTUCKY 

Hamilton/Avnet 
805 A. Newtown Circle 
Lexington 4051 1 
Tel: (606) 259-1475 
FAX: (606) 252-3238 

MARYLAND 

Arrow/Schweber Electronics 
9800J Patuxent Woods Dr. 
Columbia 21046 
Tel: (301) 596-7800 
FAX: (301) 995-6201 

Avnet Computer 

7172 Columbia Gateway Dr., #G 

Columbia 21045 

Tel: (301) 995-3571 

FAX: (301) 995-3515 

Hamilton/Avnet 

7172 Columbia Gateway Dr., #F 

Columbia 21045 

Tel: (301) 995-3554 

FAX: (301) 995-3515 

*North Atlantic Industries 
Systems Division 
7125 River Wood Dr. 
Columbia 21046 
Tel: (301) 312-5800 
FAX: (301) 290-7951 

Pioneer Technologies Group 
15810 Gaither Road 
Gaithersburg 20877 
Tel: (301) 921-0660 
FAX: (301) 670-6746 

MASSACHUSETTS 

Arrow/Schweber Electronics 
25 Upton Dr. 
Wilmington 01887 
Tel: (508) 658-0900 
FAX: (508)694-1754 

Avnet Computer 
10 D Centennial Drive 
Peabody 01960 
Tel: (508) 532-9886 
FAX: (508) 532-9660 

Hamilton/Avnet 
10 D Centennial Drive 
Peabody 01960 
Tel: (508) 531-7430 
FAX: (508) 532-9802 

Pioneer-Standard 
44 Hartwell Avenue 
Lexington 02173 
Tel: (617) 861-9200 
FAX: (617) 863-1547 

Wyle Laboratories 
15 Third Avenue 
Burlington 01803 
Tel: (617) 272-7300 
FAX: (617) 272-6809 



MICHIGAN 

Arrow/Schweber Electronics 



Livonia 48152 
Tel: (800) 231-7902 
FAX: (313) 462-2686 

Avnet Computer 

2876 28th Street. S.W., #5 

Grandville 49418 

Tel: (616) 531-9607 

FAX: (616)531-0059 

Avnet Computer 

41650 Garden Brook Rd. #120 

Novl 48375 

Tel: (313) 347-1820 

FAX: (313) 347-4067 

Hamilton/Avnet 

2876 28th Street, S.W., #5 

Grandville 49418 

Tel: (616) 243-8805 

FAX: (616) 531-0059 

Hamilton/Avnet 

41650 Garden Brook Rd., #100 

Novi 48375 

Tel: (313) 347-4270 

FAX: (313) 347-4021 

Pioneer-Standard 
4505 Broadmoor S.E. 
Grand Rapids 49512 
Tel: (616) 698-1800 
FAX: (616) 698-1831 

Pioneer-Standard 
13485 Stamford 
Livonia 48150 
Tel: (313) 525-1800 
FAX: (313) 427-3720 

MINNESOTA 

Arrow/Schweber Electronics 
10100 Viking Drive, #100 
Eden Prairie 55344 
Tel: (612) 941-5280 
FAX: (612) 942-7803 

Avnet Computer 
10000 West 76th Street 
Eden Prairie 55344 
Tel: (612) 829-0025 
FAX: (612) 944-2781 

Hamilton/Avnet 
12400 Whitewater Drive 
MInnetonka 55343 
Tel: (612) 932-0600 
FAX: (612) 932-0613 

Pioneer-Standard 

7625 Golden Triange Dr., #G 

Eden Prairie 55344 

Tel: (612) 944-3355 

FAX: (612) 944-3794 

MISSOURI 

Arrow/Schweber Electronics 
2380 Schuetz Road 
St. Louis 63141 
Tel: (314) 567-6888 
FAX: (314) 567-1164 

Avnet Computer 
739 Goddard Avenue 
Chesterfield 63005 
Tel: (314) 537-2725 
FAX: (314) 537-4248 

Hamilton/Avnet 
741 Goddard 
Chesterfield 63005 
Tel: (314) 537-1600 
FAX: (314) 537-4248 

NEW HAMPSHIRE 

Avnet Computer 
2 Executive Park Drive 
Bedford 03102 
Tel: (800) 442-8638 
FAX: (603) 624-2402 



NEW JERSEY 

Arrow/Schweber Electronics 
4 East Stow Rd., Unit 11 
Marlton 08053 
Tel: (609) 596-8000 
FAX: (609) 596-9632 

Arrow/Schweber Electronics 
43 Route 46 East 
Pine Brook 07058 
Tel: (201) 227-7880 
FAX: (201) 538-4962 

Avnet Computer 

1-B Keystone Ave., BIdg. 36 

Cherry Hill 08003 

Tel: (609) 424-8961 

FAX: (609) 751-2502 

Hamllton/Avnet 
1 Keystone Ave., BIdg. 36 
Cherry Hill 08003 
Tel: (609) 424-0110 
FAX: (609) 751-2552 

Hamilton/Avnet 
10 Industrial 
Fairfield 07006 
Tel: (201) 575-3390 
FAX: (201) 575-5839 

MTI Systems Sales 
6 Century Drive 
Parsippany 07054 
Tel: (201) 882-8780 
FAX: (201) 539-6430 

Pioneer-Standard 
14-A Madison Rd. 
Fairfield 07006 
Tel: (201) 575-3510 
FAX: (201) 575-3454 

NEW MEXICO 

Alliance Electronics, Inc. 
10510 Research Avenue 
Albuquerque 87123 
Tel: (505) 292-3360 
FAX: (505) 275-6392 

Avnet Computer 
7801 Academy Road 
BIdg. 1, Suite 204 
Albuquerque 87109 
Tel: (505) 828-9725 
FAX: (505) 828-0360 

Hamllton/Avnet 
7801 Academy Rd. N.E. 
BIdg. 1, Suite 204 
Albuquerque 87108 
Tel: (505) 765-1500 
FAX: (505) 243-1395 

NEW YORK 

Arrow/Schweber Electronics 

3375 Brighton Henrietta Townline Rd. 

Rochester 14623 

Tel: (716) 427-0300 

FAX: (716) 427-0735 

Arrow/Schweber Electronics 
20 Oser Avenue 
Hauppauge 11788 
Tel: (516) 231-1000 
FAX: (516) 231-1072 

Avnet Computer 
933 Motor Parkway 
Hauppauge 11788 
Tel: (516) 434-7443 
FAX: (516) 434-7426 

Avnet Computer 
2060 Townline Rd. 
Rochester 14623 
Tel: (716) 272-9110 
FAX: (716) 272-9685 

Hamilton/Avnet 
933 Motor Parkway 
Hauppauge 11788 
Tel: (516) 231-9800 
FAX: (516) 434-7426 



Hamilton/Avnet 
2060 Townline Rd. 
Rochester 14623 
Tel: (716) 292-0730 
FAX: (716) 292-0810 

Hamilton/Avnet 
103 Twin Oaks Drive 
Syracuse 13120 
Tel: (315) 437-2641 
FAX: (315) 432-0740 

MTI Systems 
1 Penn Plaza 
250 W. 34th Street 
New York 10119 
Tel: (212) 643-1280 
FAX: (212) 643-1288 

Pioneer-Standard 
68 Corporate Drive 
Binghamton 13904 
Tel: (607) 722-9300 
FAX: (607) 722-9562 

Pioneer-Standard 

60 Crossway Park West 

Woodbury, Long Island 11797 

Tel: (516) 921-8700 

FAX: (516) 921-2143 

Pioneer-Standard 
840 Falrport Park 
Fairport 14450 
Tel: (716) 381-7070 
FAX: (716) 381-5955 



NORTH CAROLINA 

Arrow/Schweber Electronics 
5240 Greensdairy Road 
Raleigh 27604 
Tel: (919) 876-3132 
FAX: (919) 878-9517 

Avnet Computer 
2725 Millbrook Rd., #123 
Raleigh 27604 
Tel: (919) 790-1735 
FAX: (919) 872-4972 

Hamilton/Avnet 
5250-77 Center Dr. #350 
Charlotte 28217 
Tel: (704) 527-2485 
FAX: (704) 527-8058 

Hamilton/Avnet 
3510 Spring Forest Drive 
Raleigh 27604 
Tel: (919) 878-0819 

Pioneer Technologies Group 
9401 L-Southern Pine Blvd. 
Charlotte 28210 
Tel: (704) 527-8188 
FAX: (704) 522-8564 

Pioneer Technologies Group 
2810 Meridian Parkway, #148 
Durham 27713 
Tel: (919) 544-5400 
FAX: (919) 544-5885 

OHIO 

Arrow Commercial Systems Group 

284 Cramer Creek Court 

Dublin 43017 

Tel: (614) 889-9347 

FAX: (614) e 



/^row/Schweber Electronics 
6573 Cochran Road, #E 
Solon 44139 
Tel: (216) 248-3990 
FAX: (216) 248-1106 

Arrow/Schweber Electronics 
8200 Washington Village Dr. 
Centerville 45458 
Tel: (513) 435-5563 
FAX: (513) 435-2049 



•Self Certified Small Business per Federal Acquisition Regulations 
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OHIO (Contd.) 

Avnet Computer 

7764 Washington Village Dr. 

Dayton 45459 

Tei: (513) 439-6756 

FAX: (513) 439-6719 

Avnet Connputer 

30325 Bainbridge Rd., BIdg. A 

Solon 44139 

Tel: (216) 349-2505 

FAX: (216) 349-1894 

Hamilton/Avnet 

7760 Washington Village Or. 

Dayton 45459 

Tel: (513) 439-6733 

FAX: (513) 439-6711 

Hamilton/Avnet 
30325 Bainbridge 
Solon 44139 
Tel: (216) 349-4910 
FAX: (216) 349-1894 

Hamilton/Avnet 

2600 Corp Exchange Drive, #180 

Columbus 43231 

Tel: (614) 882-7004 

FAX: (614) 882-8650 

MTI Systems Sales 
23404 Commerce Park Rd. 
Beachwood 44122 
Tel: (216) 464-6688 
FAX: (216) 464-3564 

Pioneer-Standard 
4433 Interpoint Boulevard 
Dayton 45424 
Tel: (513) 236-9900 
FAX: (513) 236-8133 

Pioneer-Standard 
4800 E. 131st Street 
Cleveland 44105 
Tel: (216) 587-3600 
FAX: (216) 663-1004 

OKLAHOMA 

Arrow/Schweber Electronics 

12111 East 51st Street, #101 

Tulsa 74146 

Tel: (918) 252-7537 

FAX: (918) 254-0917 

Hamilton/Avnet 

12121 E.SIstSt., #102A 

Tulsa 74146 

Tel: (918) 252-7297 

FAX: (918) 250-8763 

OREGON 

Almac/Arrow Electronics 
1885 N.W. 169th Place 
Beaverton 97006 
Tel: (503) 629-8090 
FAX: (503) 645-0611 

Avnet Computer 

9409 Southwest Nimbus Ave. 

Beaverton 97005 

Tel: (503) 627-0900 

FAX: (503) 526-6242 

Hamilton/Avnet 

9750 Southwest Nimbus Ave. 

Beaverton 97005 

Tel: (503) 627-0201 

FAX: (503) 641-4012 

ryle Laboratories 

j40 Sunshine Court 
BIdg. G, Suite 200 
Beaverton 97005 
Tel: (503) 643-7900 
FAX: (503) 646-5466 

PENNSYLVANIA 

Avnet Computer 

213 Executive Drive, #320 

Mars 16046 

Tel: (412) 772-1888 

FAX: (412) 772-1890 



Wyle 
9640 



Hamilton/Avnet 
213 Executive, #320 
Mars 16045 
Tel: (412)281-4152 
FAX: (412) 772-1890 

Pioneer-Standard 
259 Kappa Drive 
Pittsburgh 15238 
Tel: (412) 782-2300 
FAX: (412) 963-8255 

Pioneer Technologies Group 
500 Enterprise Road 
Keith Valley Business Center 
Horsham 19044 
Tel: (215) 674-4000 
FAX: (215) 674-3107 

TEXAS 

Arrow/Schweber Electronics 
3220 Commander Drive 
Carrollton 75006 
Tel: (214) 380-6464 
FAX: (214) 248-7208 

Avnet Computer 
4004 Beltline, Suite 200 
Dallas 75244 
Tel: (214) 308-8181 
FAX: (214) 308-8129 

Avnet Computer 

1235 North Loop West. #525 

Houston 77008 

Tel: (713) 867-7500 

FAX: (713) 861-6851 

Hamilton/Avnet 
1826-F Kramer Lane 
Austin 78758 
Tel: (512) 832-4306 
FAX: (512) 832-4315 

Hamilton/Avnet 

4004 Beltline, Suite 200 

Dallas 75244 

Tel: (214) 308-8111 

FAX: (214) 308-8109 

Hamilton/Avnet 

1235 North Loop West, #521 

Houston 77008 

Tel: (713) 240-7733 

FAX: (713) 861-6541 

Pioneer-Standard 
1826-D Kramer Lane 
Austin 78758 
Tel: (512) 835-4000 
FAX: (512) 835-9829 

Pioneer-Standard 
13765 Beta Road 
Dallas 75244 
Tel: (214) 263-3168 
FAX: (214) 490-6419 

Pioneer-Standard 
10530 Roclcley Road. #100 
Houston 77099 
Tel: (713) 495-4700 
FAX: (713) 495-5642 

Wyle Laboratories 
1810 Greenville Avenue 
Richardson 75081 
Tel: (214) 235-9953 
FAX: (214) 644-5064 

Wyle Laboratories 

4030 West Braker Lane, #330 

Austin 78758 

Tel: (512) 345-8853 

FAX: (512) 345-9330 

Wyle Laboratories 
11001 South Wilcrest, #100 
Houston 77099 
Tel: (713) 879-9953 
FAX: (713) 879-6540 

UTAH 

Arrow/Schweber Electronics 
1946 W. Parkway Blvd. 
Salt Lake City 84119 
Tel: (801) 973-6913 



Avnet Computer 
1100E. 6600 South, #150 
Salt Uke City 84121 
Tel: (801) 266-1115 
FAX: (801) 266-0362 

Hamilton/Avnet 

1100 East 6600 South, #120 

Salt Uke City 84121 

Tel: (801) 972-2800 

FAX: (801) 263-0104 

Wyle Laboratories 
1325 West 2200 South, #E 
West Valley 84119 
Tel: (801) 974-9953 
FAX: (601) 972-2524 

WASHINGTON 

Almac/Arrow Electronics 
14360 S.E. Eastgate Way 
Bellevue 98007 
Tel: (206) 643-9992 
FAX: (206) 643-9709 

Hamilton/Avnet 

17761 N.E. 78th Place, #C 

Redmond 98052 

Tel: (206) 241-8555 

FAX: (206) 241-5472 

Avnet Computer 

17761 Northeast 78th Place 

Redmond 98052 

Tel: (206) 867-0160 

FAX: (206) 867-0161 

Wyle Laboratories 
1^85 N.E. 90th Street 
Redmond 98052 
Tel: (206) 881-1150 
FAX: (206) 881-1567 

WISCONSIN 

Arrow/Schweber Electronics 
200 N. Patrick Blvd., #100 
Brookfield 53005 
Tel: (414) 792-0150 
FAX: (414) 792-0156 

Avnet Computer 

20875 Crossroads Circle, #400 

Waukesha 53186 

Tel: (414) 784-8205 

FAX: (414) 784-6006 

Hamilton/Avnet 

28875 Crossroads Circle, #400 

Waukesha 53186 

Tel: (414) 784-4510 

FAX: (414) 784-9509 

Pioneer-Standard 
120 Bishops Way #163 
Brookfield 53005 
Tel: (414) 784-3480 

ALASKA 

Avnet Computer 

1400 West Benson Blvd., #400 

Anchorage 99503 

Tel: (907) 274-9899 

FAX: (907) 277-2639 



CANADA 



ALBERTA 

Avnet Computer 

2816 21st Street Northeast 

Calgary T2E 6Z2 

Tel: (403) 291-3284 

FAX: (403) 250-1591 

Zentronlcs 

6815 8th Street N.E.. #100 

Calgary T2E 7H 

Tel: (403) 295-8838 

FAX: (403) 295-8714 

BRITISH COLUMBIA 

Almac-Arrow Electronics 
8544 Baxter Place 
Burnaby V5A 4T8 
Tel: (604) 421-2333 
FAX: (604) 421-5030 



Hamilton/Avnet 
8610 Commerce Court 
Burnaby V5A 4N6 
Tel: (604) 420-4101 
FAX: (604) 420-5376 

Zentronlcs 

11400 Bridgeport Rd., #108 

Richmond V6X 1T2 

Tel: (604) 273-5575 

FAX: (604) 273-2413 



ONTARIO 

Arrow/Schweber Electronics 
36 Antares Dr., Unit 100 
Nepean K2E 7W5 
Tel: (613) 226-6903 
FAX: (613) 723-2018 

Arrow/Schweber Electronics 
1093 Meyerside, Unit 2 
MississaugaL5T1M4 
Tel: (416) 670-7769 
FAX: (416) 670-7781 

Avnet Computer 
151 Superior Blvd. 
Mississuaga L5T 2L1 
Tel: (416) 795-3835 

Avnet Computer 
190 Colonade Road 
Nepean K2E 7J5 
Tel: (613) 727-2000 
FAX: (613) 226-1184 

Hamilton/Avnet 

151 Superior Blvd., Units 1-6 

Mississauga L5T 2L1 

Tel: (416) 564-6060 

FAX: (416) 564-6033 

Hamilton/Avnet 
190 Colonade Road 
Nepean K2E 7J5 
Tel: (613) 226-1700 
FAX: (613) 226-1184 

Zentronlcs 

1355 Meyerside Drive 
Mississauga L5T1C9 
Tel: (416) 564-9600 
FAX: (416) 564-3127 

Zentronlcs 

155 Colonade Rd., South 

Unit 17 

Nepean K2E 7K1 

Tel: (613) 226-8840 

FAX: (613) 226-6352 



QUEBEC 

Arrow/Schweber Electronics 
1100 St. Regis Blvd. 
DorvalH9P2T5 
Tel: (514) 421-7411 
FAX: (514) 421-7430 

Arrow/Schweber Electronics 
500 Boul. St-Jean-Baptiste Ave. 
Quebec H2E 5R9 
Tel: (418) 871-7500 
FAX: (418) 871-6816 

Avnet Computer 
2795 Rue Halpem 
St. Laurent H4S1P8 
Tel: (514) 335-2483 
FAX: (514) 335-2481 

Hamilton/Avnet 
2795 Halpem 
St. Laurent H4S1P8 
Tel: (514) 335-1000 
FAX: (514) 335-2481 

Zentronlcs 
520 McCafTrey 
St. Laurent H4T1N3 
Tel: (514) 737-9700 
FAX: (514) 737-5212 



inlel 
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EUROPEAN SALES OFFICES 



FINUND 

Intel Rnland OY 
Ruosilantie 2 
00390 Helsinki 
Tel: (358) 544 644 
FAX: (358) 544 030 

FRANCE 

Intel Corporation S.A.R.L. 

1, Rue Edi8on-BP303 

78054 St. Quentin-en-Yvellnee 

Cedex 

Tel: (33) (1) 30 57 70 00 

FAX: (33) (1) 30 64 60 32 



GERMANY 

Intel GmbH 

Domacher Strasse 1 

8016 Feldklrchen bel Muenchen 

Tel: (49) 089/90992-0 

FAX: (49) 089/9043948 

ISRAEL 

Intel Semiconductor Ltd. 

Atldlm Industrial Park-Neve Sharet 

P.O. Box 43202 

Tel-AvIv 61430 

Tel: (972) 03 498080 

FAX: (972) 03 491870 



ITALY 

Intel Corporation Italia S.p.A. 

Mllanofiori Palazzo E 

20094 Assago 

Milano 

Tel: (39) (02) 89200950 

FAX: (39) (2) 3498464 

NETHERLANDS 

Intel Semiconductor B.V. 
Postbus 84130 
3009 CC Rotterdam 
Tel: (31) 10 407 11 11 
FAX: (31) 10 455 4688 



SPAIN 

Intel Iberia S.A. 
Zubaran, 28 
28010 Madrid 
Tel: (34) 308 25 52 
FAX: (34) 410 7570 

SWEDEN 

Intel Sweden AB. 
Dalvagen 24 
171 36 Solna 
Tel: (48) 8 734 01 00 
FAX: (46) 8 278085 



UNITED KINGDOM 

Intel Corporation (U.K.) Ltd. 
Pipers Way 

Swindon, Wiltshire SN3 1RJ 
Tel: (44) (0793) 696000 
FAX: (44) (0793) 641440 



EUROPEAN DISTRIBUTORS/REPRESENTATIVES 



AUSTRIA 

Bacher Electronics GmbH 

Rotenmuehtgasse 26 

A-1120Wien 

Tel: 43 222 81356460 

FAX: 43 222 834276 

BELGIUM 

Ineico Belgium S.A. 

Avenue des Croix de Guerre 94 

1120Bruxelles 

Tel: 32 2 244 2811 

FAX: 32 2 216 4301 

FRANCE 

Almex 

48, Rue de I'Aubepine 

B.P. 102 

92164 Antony Cedex 

Tel: 33 1 4096 5400 

FAX: 33 1 4666 6028 

Lex Electronics 

60-62 Rue des Je'meaux 

Siiic 585 

94663 Rungis Cedex 

Tel: 33 1 4978 4978 

FAX: 33 1 4978 0596 

Tekelec 

5 Rue Carle Vernet 

BP2 

92310 Sevres 

Tel: 33 1 4623 2425 

FAX: 33 1 4507 2191 

GERMANY 

E2000 Vertriebs-AG 
Stahlgruberring 12 
8000 Muenchen 82 
Tel: 49 89 420010 
FAX: 49 89 42001209 

Jermyn GmbH 
Im Dachsstueck 9 
6250 Limburg 
Tel: 49 6431 5080 
FAX: 49 6431 508289 



Proelectron Vertriebs GmbH 
Max-Planck-Strasse 1-3 
6072 Dreieich 
Tel: 49 6103 304343 
FAX: 49 6103 304425 

GREECE 

Pouliadis Associates Corp. 
5 Koumbarl Street 
Kolonaki Square 
10674 Athens 
Tel: 30 1 360 3741 
FAX: 30 1 360 7501 

IRELAND 

Micro Marketing 

Taney Hall 

Eglinton Terrace 

Dundrum 

Dublin 14 

Tel: 010 3531 989 400 

FAX: 010 3531 989 828 

ISRAEL 

Eastronics Ltd. 
Rozanis 1 1 
P.O.B. 39300 
Tel Baruch 
Tel-Aviv 61392 
Tel: 972 3 6458777 
FAX: 972 3 6458666 

ITALY 

Intesi Div. Delia Deutsche 
Divisions ITT Industries GmbH 
P.I. 06550110156 
20094 Assago (Milano) 
Tel: 39 2 824701 
FAX: 39 2 8242631 

Las! Elettronica S.P.A. 
P.I. 00839000155 
Viale Fulvio Testi, N.280 
20126 Milano 
Tel: 39 2 66101370 
FAX: 39 2 66101385 



NETHERLANDS 

Datelcom 
Energieweg 1 
2627 AP Delft 
Tel: 31 15 609 906 
FAX: 31 15 619 194 

Diode Components b.v. 
Coltbaan 17 
3439 NG Nieuwegein 
Tel: 3402 91234 
FAX: 3402 35924 



SOUTH AFRICA 

EBE 

P.O. Box 912-1222 
Silverton 0127 
Tel: 27 12 803 7680 
FAX: 27 12 803 8294 



SPAIN 

ATD Electronica, S.A. 

Avda de la Industrie, 32 

Nave 17, 2B 

28100 Alcobendas 

Madrid 

Tel: 34 1 661 6551 

FAX: 34 1 661 6300 



SCANDINAVIA 

OY Rntronic AB 

Heikkilantie 2a 

SF-0210 Helsinki 

Finland 

Tel: 358 6926022 

FAX: 358 6821251 

ITT Multikomponent A/S 

Naverland 29 

DK-2600 Glostrup 

Denmark 

Tel: 45 42 451822 

FAX: 45 42 450724 



Nortec Electronics A/S 

Postboks 123 

Smedsvlngen 4B 

N-1364 Hvalstad 

Norway 

Tel: 47 2 846210 

FAX: 47 2 846545 

Nortec Electronics AB 

Parkvagen 2A 

S-171 

27 Solna 

Sweden 

Tel: 46 8 7051850 



SWITZERLAND 

Industrade A.Q. 
Hertistrasse 31 
CH-8304 Wailisellen 
Tel: 41 1 8328111 
FAX: 41 1 8307550 



TURKEY 

EMPA 

Florya Js Merkezi 

Besyol Londra Asfaltl 

34630 Ftorya 

Istanbul 

Tel: 901 5993050 

FAX: 901 5955353 



UNITED KINGDOM 

Avnet-Access 
Jubilee House 
Jubilee Road 
Letchworth 
Hertsfordshire 
SG6 1QH 
Tel: 0462 480888 
FAX: 0462 682467 



Bytech Components Ltd. 
iSaCedarwood 
Chineham Business Park 
Crockford Lane 
Basingstoke 
Hants RQ12 1RW 
Tel: 0256 707107 
FAX: 0256 707162 

Jermyn 
Vestry Estate 
Otford Road 
Sevenoaks 
KentTN14 5EU 
Tel: 0732 743743 
FAX: 0732 451251 

MMD/Rapid 
3 Bennet Court 
Bennet Road 
Reading 

Berkshire RG2 OQX 
Tel: 0734 313232 
FAX: 0734 313255 



YUGOSLAVIA 

H.R. Microelectronics Corp. 

2005 de la Cruz Blvd. 

Suite 220 

Santa Clara, CA 95050 

U.S.A. 

Tel: (408) 988-0286 

FAX: (408) 988-0306 
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INTERNATIONAL SALES OFFICES 



AUSTRALIA 

Intel Australia Pty. Ltd. 

Unit 13 

Ailambie Grove Business Park 

25 Frenchs Forest Road East 

Frenchs Forest, NSW. 2086 

Sydney 

Tel: 61-2-975-3300 

FAX: 61-2-975-3375 

Intel Australia Pty. Ltd. 

711 High Street 

1st Floor 

East Kw. Vic, 3102 

Melbourne 

Tel: 61-3-810-2141 

FAX: 61-3-819 7200 

BRAZIL 

Intel Semiconductores do Brazil LTDA 
Avenida Paulista, 1159-CJS 404/405 
CEP 01311 - Sao Paulo - S.P. 
Tel: 55-11-287-5899 
TLX: 11-37-557-ISDB 
FAX: 55-11-287-5119 

CHINA/HONG KONG 

Intel PRO Corporation 
15/F, Office I.CiticBldg. 
Jian Guo Men Wai Street 
Beijing, PRO 
Tel: (1) 500-4850 
TLX: 22947 INTEL CN 
FAX: (1) 500-2953 



Intel Semiconductor Ltd.* 
10/F East Tower 
Bond Center 
Queensway, Central 
Hong Kong 
Tel: (852) §44-4555 
FAX: (852) 868-1989 



INDIA 

Intel Asia Electronics, Inc. 

4/2, Samrah Plaza 

St. Mark's Road 

Bangalore 560001 

Tel: 91-812-215773 

TLX: 953-845-2646 INTEL IN 

FAX: 091-812-215067 



JAPAN 

Intel Japan K.K. 

5-6 Tokodai, Tsukuba-shI 

IbarakI, 300-26 

Tel: 0298-47-8511 

FAX: 0298-47-8450 

Intel Japan KK.* 
Hachioii ON Bidg. 
4-7-14 Myojin-machi 
Hachioji-shi, Tokyo 192 
Tel: 0426-48-8770 
FAX: 0426-48-8775 



Intel Japan K.K.* 
Bidg. Kumagaya 
2-69 Hon-cho 

Kumagaya-shi, Saitama 360 
Tel: 0485-24-6871 
FAX: 0485-24-7518 

Intel Japan K.K.* 

Kawa-asa Bidg. 

2-1 1-5 Shin-Yokohama 

Kohoku-ku, Yokohama-Shi 

Kanagawa, 222 

Tel: 045-474-7660 

FAX: 045-471-4394 

Intel Japan K.K.* 
Ryokuchi-Eki Bidg. 
2-4-1 Terauchi 
Toyonaka-shi, Osaka 560 
Tel: 06-863-1091 
FAX: 06-863-1084 

Intel Japan K.K. 
Shinmaru Bidg. 
1-5-1 Marunouchi 
Chiyoda-ku, Tokyo 100 
Tel: 03-3201-3621 
FAX: 03-3201-6850 

Intel Japan K.K. 
Green Bidg. 
1-16-20 Nishiki 
Naka-ku, Nagoya-shi 
Aichi 460 
Tel: 052-204-1261 
FAX: 052-204-1285 



KOREA 

Intel Korea, Ltd. 

16th Floor, Life Bidg. 

61 Yoido-dong, Youngdeungpo-Ku 

Seoul 150-010 

Tel: (2) 784-8186 

FAX: (2) 784-8096 



SINGAPORE 

Intel Singapore Technology, Ltd. 
101 Thomson Road #08-03/06 
United Square 
Singapore 1130 
Tel: (65) 250-7811 
FAX: (65) 250-9256 



TAIWAN 

Intel Technology Far East Ltd. 

Taiwan Branch Office 

8th Floor, No. 205 

Bank Tower Bidg. 

Tung Hua N. Road 

Taipei 

Tel: 886-2-5144202 

FAX: 886-2-717-2455 



INTERNATIONAL DISTRIBUTORS/REPRESENTATIVES 



ARGENTINA 

Dafsys S.R.L. 
Chacabuco, 90-6 Piso 
1069-Buenos Aires 
Tel. & FAX: 54.1334.1871 



AUSTRALIA 

Email Electronics 
15-17 Hume Street 
Huntingdale, 3166 
Tel: 011-61-3-544-8244 
TLX: AA 30895 
FAX: 011-61-3-543-8179 

NSD-Australla 
205 Middleborough Rd. 
Box Hill, Victoria 3128 
Tel: 03 8900970 
FAX: 03 8990819 



BRAZIL 

Microlinear 

Largo do Arouche, 24 
01219 Sao Paulo, SP 
Tel: 5511-220-2215 
FAX: 5511-220-5750 



CHILE 

Sisteco 

Vecinal 40 -Las Condes 

Santiago 

Tel: 562-234-1644 

FAX: 562-233-9895 



CHINA/HONG KONG 

Novel Precision Machinery Co., Ltd. 

Room 728 Trade Square 

681 Cheung Sha Wan Road 

Kowloon, Hong Kong 

Tel: (852) 360-8999 

7WX: 32032 NVTNL HX 

FAX: (852) 725-3695 



GUATEMALA 

Abinitio 

11 Calle2-Zona9 
Guatemala City 
Tel: 5022-32-4104 
FAX: 5022-32-4123 



INDIA 

Micronic Devices 
Arun Complex 
No. 65 D.V.G. Road 
Basavanagudi 
Bangalore 560 004 
Tel: 011-91-812-600-631 
011-91-812-611-365 
TLX: 9538458332 MDBG 

Micronic Devices 

No. 516 5th Floor 

Swastik Chambers 

Sion, Trombay Road 

Chembur 

Bombay 400 071 

TLX: 9531 171447 MDEV 

Micronic Devices 
25/8, 1st Floor 
Bada Bazaar Marg 
Old Rajinder Nagar 
New Delhi 110 060 
Tel: 011-91-11-5723509 

011-91-11-589771 
TLX: 031-63253 MDND IN 

Micronic Devices 

6-3-348/1 2A Dwarakapuri Colony 

Hyderabad 500 482 

Tel: 011-91-842-226748 

S&S Corporation 
1587Kooser Road 
San Jose, CA95118 
Tel: (408) 978-6216 
TLX: 820281 
FAX: (408) 978-8635 

JAMAICA 

MC Systems 
10-12 Grenada Crescent 
Kingston 5 
Tel: (809) 929-2638 
(809) 926-0188 
FAX: (809) 926-0104 

JAPAN 

Asahl Electronics Co. Ltd. 
KMM Bidg. 2-14-1 Asano 
Kokurakita-ku 
Kitakyushu-shi 802 
Tel: 093-511-6471 
FAX: 093-551-7861 



CTC Components Systems Co., Ltd. 
4-8-1 Dobashi, Miyamae-ku 
Kawasaki-Shi. Kanagawa 213 
Tel: 044-852-5121 
FAX: 044-877-4268 

Dia Semicon Systems, Inc. 

Flower Hill Shinmachi Higashi-kan 

1-23 Shinmachi, Setagaya-ku 

Tokyo 154 

Tel: 03-3439-1600 

FAX: 03-3439-1601 

Okaya Kokl 
2-4-18 Sakae 
Naka-ku, Nagoya-shi 460 
Tel: 052-204-8315 
FAX: 052-204-8380 

Ryoyo Electro Corp. 
Konwa Bidg. 
1-12-22 Tsukiji 
Chuo-ku, Tokyo 104 
Tel: 03-3546-501 1 
FAX: 03-3546-5044 

KOREA 

J-Tek Corporation 

Dong Sung Bidg. 9/F 

158-24. Samsung-Dong, Kangnam-Ku 

Seoul 135-090 

Tel: (822) 557-8039 

FAX: (822) 557-8304 

Samsung Electronics 



Samsung Main Bidg. 
150 Taepyung-Ro-2KA, C 
Seoul 100-102 



150 Taepyung-Ro-2KA, Chung-Ku 



C.P.O. Box 8780 
Tel: (822) 751-3680 
TWX: KORSST K 27970 
FAX: (822) 753-9065 

MEXICO 

PSI S.A. de C.V. 
Fco. Villa esq. Ajusco s/n 
Cuernavaca, MOR 62130 
Tel: 52-73-13-9412 
52-73-17-5340 
FAX: 52-73-17-5333 

NEW ZEALAND 

Email Electronics 
36 Olive Road 
Penrose, Auckland 
Tel: 011-64-9-591-155 
FAX: 011-64-9-592-681 



SAUDI ARABIA 

AAE Systems, Inc. 

642 N. Pastoria Ave. 

Sunnyvale, CA 94086 

U.S.A. 

Tel: (408) 732-1710 

FAX: (408) 732-3095 

TLX: 494-3405 AAE SYS 

SINGAPORE 

Electronic Resources Re, Ltd. 
17 Harvey Road 
#03-01 Singapore 1336 
Tel: (65) 283-0888 
TWX: RS 56541 ERS 
FAX: (65) 289-5327 

SOUTH AFRICA 

Electronic Building Elements 

178 Erasmus St. (off Watermeyet St.) 

Meyerspark, Pretoria, 0184 

Tel: 011-2712-803-7680 

FAX: 011-2712-803-8294 

TAIWAN 

Micro Electronics Corporation 
12th Floor, Section 3 
285 Nanking East Road 
Taipei, R.O.C. 
Tel: (886) 2-7198419 
FAX: (886) 2-7197916 

Acer Sertek Inc. 
15th Floor, Section 2 
Chien Kuo North Rd. 
Taipei 18479 R.O.C. 
Tel: 886-2-501-0055 
TWX: 23756 SERTEK 
FAX: (886)2-5012521 

URUGUAY 

Interfase 
Zabala 1378 
11000 Montevideo 
Tel: 5982-96-0490 
5982-96-1143 
FAX: 5982-96-2965 

VENEZUELA 

Unixel CA. 

4 Transversal de Monte Cristo 

Edf. AXXA, Piso1,of. 1&2 

Centro Empresarial Boleita 

Caracas 

Tel: 582-238-6082 

FAX: 582-238-1816 



*Field Application Location 
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NORTH AMERICAN SERVICE OFFICES 



ALASKA 

Intel Corp. 

c/o TransAlaska Network 
1515 Lore Rd. 
Anchorage 99507 
Tel: (907) 522-1776 

Intel Corp. 

c/o TransAlaska Data Systems 

c/o GCI Operations 

520 Fifth Ave., Suite 407 

Fairbanks 99701 

Tel: (907) 452-6264 

ARIZONA 

•Intel Corp. 
410 North 44th Street 
Suite 500 
Phoenix 85008 
Tel: (602) 231-0386 
FAX: (602) 244-0446 

•Intel Corp. 

500 E. Fry Blvd., Suite M-15 

Sierra Vista 85635 

Tel: (602)459-5010 

ARKANSAS 

Intel Corp. 
c/o Federal Express 
1500 West Park Drive 
Little Rock 72204 

CALIFORNIA 

•Intel Corp. 

21515 Vanowen St., Ste. 116 

Canoga Park 91303 

Tel: (818) 704-8500 

•Intel Corp. 

300 N. Continental Blvd. 

Suite 100 

El Segundo 90245 

Tel: (213) 640-6040 

•Intel Corp. 
1900 Prairie City Rd. 
Folsom 95630-9597 
Tel: (916) 351-6143 

•Intel Corp. 

9665 Chesapeake Dr., Suite 325 

San Diego 92123 

Tel: (619) 292-8086 

••Intel Corp. 

400 N. Tustin Avenue 

Suite 450 

Santa Ana 92705 

Tel: (714) 835-9642 

••Intel Corp. 

2700 San tomas Exp., 1st Floor 

Santa Clara 95051 

Tel: (408) 970-1747 

COLORADO 

•Intel Corp. 

600 S. Cherry St., Suite 700 

Denver 80222 

Tel: (303) 321-8086 



CONNECTICUT 

•Intel Corp. 

301 Lee Farm Corporate Park 

83 Wooster Heights Rd. 

Danbury 0681 1 

Tel: (203) 748-3130 

FLORIDA 

••Intel Corp. 

800 Fairway Dr., Suite 160 
Deerfieid Beach 33441 
Tel: (305) 421-0506 
FAX: (305) 421-2444 

•Intel Corp. 

5850 T.G. Lee Blvd., Ste. 340 

Orlando 32822 

Tel: (407) 240-8000 

GEORGIA 

•Intel Corp. 

20 Technology Park, Suite 150 

Norcross 30092 

Tel: (404) 449-0541 

5523 Theresa Street 
Columbus 31907 



••Intel Corp. 
Honolulu 96820 
Tel: (808) 847-6738 

ILLINOIS 

••tintel Corp. 
Woodfield Corp. Center III 
300 N. Martingale Rd., Ste. 400 
Schaumburg 60173 
Tel: (708) 605-8031 

INDIANA 

•Intel Corp. 

8910 Purdue Rd., Ste. 350 
Indianapolis 46268 
Tel: (317) 875-0623 

KANSAS 

•Intel Corp. 

10985 Cody, Suite 140 
Overland Park 66210 
Tel: (913) 345-2727 

KENTUCKY 

Intel Corp. 

133 Walton Ave., Office 1 A 

Lexington 40508 

Tel: (606) 255-2957 

Intel Corp. 

896 Hillcrest Road, Apt. A 

Radcliff 40160 (Louisville) 



Hammond 70401 

(serviced from Jackson, MS) 



MARYLAND 

••Intel Corp. 

10010 Junction Dr., Suite 200 
Annapolis Junction 20701 
Tel: (301) 206-2860 

MASSACHUSETTS 

••Intel Corp. 
Westford Corp. Center 
3 Carlisle Rd., 2nd Floor 
Westford 01886 
Tel: (508) 692-0960 

MICHIGAN 

•Intel Corp. 

7071 Orchard Lake Rd., Ste. 100 

West Bloomfield 48322 

Tel: (313) 851-8905 

MINNESOTA 

•Intel Corp. 

3500 W. 80th St., Suite 360 
Bloomington 55431 
Tel: (612) 835-6722 

MISSISSIPPI 

Intel Corp. 

c/o Compu-Care 

2001 Airport Road, Suite 205F 

Jackson 39208 

Tel: (601) 932-6275 

MISSOURI 

•Intel Corp. 

3300 Rider Trail South 

Suite 170 

Earth City 63045 

Tel: (314) 29M990 

Intel Corp. 
Route 2, Box 221 
Smithville 64089 
Tel: (913) 345-2727 

NEW JERSEY 

••Intel Corp. 
300 Sylvan Avenue 
Englewood Cliffs 07632 
Tel: (201) 567-0821 

•Intel Corp. 
Lincroft Office Center 
125 Half Mile Road 
Red Bank 07701 
Tel: (908) 747-2233 

NEW MEXICO 

Intel Corp. 

Rio Rancho 1 

4100 Sara Road 

Rio Rancho 87124-1025 

(near Albuquerque) 

Tel: (505) 893-7000 



NEW YORK 

•Intel Corp. 

2950 Expressway Dr. South 

Suite 130 

Islandia 11722 

Tel: (516) 231-3300 

Intel Corp. 

300 Westage Business Center 

Suite 230 

Fishkill 12524 

Tel: (914) 897-3860 

Intel Corp. 

5858 East Molloy Road 
Syracuse 13211 
Tel: (315) 454-0576 

NORTH CAROLINA 

•Intel Corp. 

5800 Executive Center Drive 

Suite 105 

Charlotte 28212 

Tel: (704) 568-8966 

••Intel Corp. 

5540 Centerview Dr., Suite 215 

Raleigh 27606 

Tel: (919) 851-9537 

OHIO 

••Intel Corp. 

3401 Park Center Dr., Ste. 220 

Dayton 45414 

Tel: (513) 890-5350 

•Intel Corp. 

25700 Science Park Dr., Ste. 100 

Beachwood 441 22 

Tel: (216) 464-2736 

OREGON 

••Intel Corp. 

15254 N.W. Greenbrier Pkwy. 

Building B 

Beaverton 97006 

Tel: (503) 645-8051 

PENNSYLVANIA 

•tintel Corp. 
925 Harvest Drive 
Suite 200 
Blue Bell 19422 
Tel: (215) 641-1000 
1-800-468-3548 
FAX: (215) 641-0785 

••tintel Corp. 

400 Penn Center Blvd., Ste. 610 

Pittsburgh 15235 

Tel: (412) 823-4970 

•Intel Corp. 
1513 Cedar Cliff Dr. 
Camp Hill 17011 
Tel: 0^17) 761-0860 



PUERTO RICO 

Intel Corp. 

South Industrial Park 
P.O. Box 910 
Las Piedras 00671 
Tel: (809) 733-8616 

TEXAS 

••Intel Corp. 

Westech 360, Suite 4230 

8911 N. Capitol of Texas Hwy. 

Austin 78752-1239 

Tel : (512) 794-8086 

••tintel Corp. 

12000 Ford Rd., Suite 401 

Dallas 75234 

Tel: (214) 241-8087 

••Intel Corp. 

7322 SW f^reeway. Suite 1490 

Houston 77074 

Tel: (713) 988-8086 

UTAH 

Intel Corp. 

428 East 6400 South 
Suite 104 
Murray 84107 
Tel: (801) 263-8051 
FAX: (801) 268-1457 

VIRGINIA 

•Intel Corp. 

9030 Stony Point Pkwy. 
Suite 360 
Richmond 23235 
Tel: (804) 330-9393 

WASHINGTON 

••Intel Corp. 

155 108th Avenue N.E., Ste. 386 

Bellevue 98004 

Tel: (206) 453-8086 

CANADA 

ONTARIO 

••Intel Semiconductor of 

Canada, Ltd. 

2650 Queensview Dr., Ste. 250 

Ottawa K2B 8H6 

Tel: (613) 829-9714 

••Intel Semiconductor of 
Canada, Ltd. 
190AttweIIDr., Ste. 102 
Rexdale CToronto) M9W 6H8 
Tel: (416) 675-2105 

QUEBEC 

••Intel Semiconductor of 

Canada, Ltd. 

1 Rue Holiday 

Suite 115 

Tour East 

R. Claire H9R 5N3 

Tel: (514) 694-9130 

FAX: 514-694-0064 



ARIZONA 

2402 W. Beardsley Road 
Phoenix 85027 
Tel: (602) 869-4288 
1-800-468-3548 



CUSTOMER TRAINING CENTERS 



SYSTEMS ENGINEERING OFFICES 



MINNESOTA 

3500 W. 80th Street 
Suite 360 

Bloomington 55431 
Tel: (612) 835-6722 



2950 Expressway Dr., South 
Islandia 11722 
Tel: (506) 231-3300 



•Carry-in locations 
'•Carry-in/mail-in locations 
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UNITED STATES 

Intel Corporation 

2200 Mission College Boulevard 

P.O. Box 58119 
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